Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Comodo AAA Services S/MIME trust thread stays unresolved

1 source · 2 articlesFirst reported Updated ()1
What's new

October 22: The visible reply says further investigation is unlikely and asks whether other mail apps inherit the NSS or Thunderbird trust store and check X.509 paths.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

An oss-security thread on Comodo AAA Services root trust for S/MIME remains open, with no CVE or confirmed misuse.

Hanno Böck posted to oss-security on October 22 about the Comodo AAA Services root and S/MIME, linking two October 21 messages. He wrote that he was unsure what those messages meant and had asked someone at Mozilla for clarification. In a later reply the same day, quoted by Steffen Nurpmeso, Böck said further investigation was unlikely and asked whether other mail clients use the NSS or Thunderbird certificate store as an S/MIME trust anchor and whether they properly validate X.509 paths. The visible text is truncated before any explanation or conclusion. No affected versions, patch, CVE, or confirmed misuse is stated.

Key facts
  • Hanno Böck posted to oss-security on October 22, 2026.
  • He linked two oss-security messages from October 21.
  • He said he asked someone at Mozilla for clarification.
  • Later that day he said further investigation was unlikely.
  • Questions cover NSS or Thunderbird stores as S/MIME trust anchors.
  • No product versions, fixes, CVE, or confirmed misuse are stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Two oss-security messages later linked by Böck. · oss-security
  2. Oct 22, 2026Böck posts on Comodo AAA Services root and S/MIME. · oss-security
  3. Oct 22, 2026Reply quotes Böck limiting further investigation. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityBöck asked Mozilla what the October 21 messages meant.
  • oss-securityNurpmeso quotes Böck on NSS trust and path checks.
Vendors
Comodo
Products
Comodo AAA Services RootThunderbirdNSS
Organizations
Mozilla

Coverage

oldest first · one row per article · UTC
  1. · 3d ago oss-securityFirst report

    Comodo AAA Services root and S/MIME raised on oss-security

    The October 22 post is truncated after Böck says he asked Mozilla what earlier messages meant.

  2. · 2d ago oss-security

    Thread questions S/MIME trust of the Comodo AAA root

    The visible post says interest is limited and leaves open whether other mail apps inherit the NSS trust store.