More apps bundle cert stores tied to the eMudhra certificate issue
Original title: Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra)
Hanno Böck points to several NixOS nixpkgs reports beyond nmap/ncat and texlive-infra.
In an oss-security reply, Hanno Böck says many more applications ship bundled certificate stores affected by the eMudhra certificate issue already raised for nmap/ncat and texlive-infra. He cites several NixOS nixpkgs issues and says stores are compiled into binaries. The post is a short follow-up and does not describe a fix or exploitation.
Unconfirmed: The feed text is truncated and does not state what is wrong with the eMudhra certificate.
- The reply names nmap/ncat and texlive-infra as already in scope.
- Böck links five NixOS nixpkgs issues, numbered 576475 and 576541 through 576544.
- He says certificate stores are compiled into additional applications.
Impact: Apps may trust a bundled eMudhra certificate
| Product | Affected |
|---|---|
| Nmap ncat | — |
| TeX Live texlive-infra | — |
| NixOS nixpkgs | — |
- Products
- ncattexlive-infranixpkgs
- Organizations
- eMudhra
From the original article
Posted by Hanno Böck on Oct 21 And there are many more applications with bundled stores. The NixOS https://github. com/NixOS/nixpkgs/issues/576475 https://github.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.