NetBSD Problem Report #60908

From www@netbsd.org  Tue Oct 20 14:29:09 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 341CB1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Tue, 20 Oct 2026 14:29:09 +0000 (UTC)
Message-Id: <20261020142907.ECB7B1A923C@mollari.NetBSD.org>
Date: Tue, 20 Oct 2026 14:29:07 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: mozilla-certdata: update for compromised CA
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60908
>Category:       security
>Synopsis:       mozilla-certdata: update for compromised CA
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    riastradh
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Oct 20 14:30:01 +0000 2026
>Last-Modified:  Tue Oct 20 15:40:03 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10
>Organization:
Honest Achmed's Used BSDs and Foundations, Inc. 
>Environment:
>Description:

	One of the CAs in mozilla-certdata was compromised:

        https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

>How-To-Repeat:

	probably a bad idea to repeat this

>Fix:

	update mozilla-certdata

>Release-Note:

>Audit-Trail:
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60908 CVS commit: pkgsrc/security
Date: Tue, 20 Oct 2026 14:45:11 +0000

 Module Name:	pkgsrc
 Committed By:	nia
 Date:		Tue Oct 20 14:45:11 UTC 2026

 Modified Files:
 	pkgsrc/security/mozilla-rootcerts: Makefile distinfo
 	pkgsrc/security/mozilla-rootcerts-openssl: Makefile
 Added Files:
 	pkgsrc/security/mozilla-rootcerts/patches: patch-certdata.txt

 Log Message:
 mozilla-rootcerts: Remove compromised CAs.

 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

 PR security/60908


 To generate a diff of this commit:
 cvs rdiff -u -r1.66 -r1.67 pkgsrc/security/mozilla-rootcerts/Makefile
 cvs rdiff -u -r1.43 -r1.44 pkgsrc/security/mozilla-rootcerts/distinfo
 cvs rdiff -u -r1.40 -r1.41 pkgsrc/security/mozilla-rootcerts-openssl/Makefile
 cvs rdiff -u -r0 -r1.5 \
     pkgsrc/security/mozilla-rootcerts/patches/patch-certdata.txt

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60908 CVS commit: src/external/mpl/mozilla-certdata/dist
Date: Tue, 20 Oct 2026 14:51:06 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Tue Oct 20 14:51:06 UTC 2026

 Update of /cvsroot/src/external/mpl/mozilla-certdata/dist
 In directory ivanova.netbsd.org:/tmp/cvs-serv13789

 Log Message:
 mozilla-certdata: Update Mozilla certdata.txt.

 nss hg date: 2026-10-20
 nss hg revision: 26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517

 PR security/60908: mozilla-certdata: update for compromised CA

 Status:

 Vendor Tag:	MOZILLA-CERTDATA
 Release Tags:	mozilla-certdata-20261020

 U src/external/mpl/mozilla-certdata/dist/certdata.txt

 No conflicts created by this import

From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Cc: 
Subject: Re: security/60908: mozilla-certdata: update for compromised CA
Date: Tue, 20 Oct 2026 14:58:37 +0000

 Workaround:

 certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_C3.pem
 certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3
 certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_C1.pem

 (Not sure all of these were compromised but they were all removed from
 certdata.txt.)

Responsible-Changed-From-To: security-officer->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Tue, 20 Oct 2026 15:40:03 +0000
Responsible-Changed-Why:
I am preparing the update, which involves a lot of annoying set list updates


>Unformatted:

Home	PR Database Search