BSD Portsca_root_nss -- trusted root certificate from compromised CA eMudhra
Problem Description: eMudhra generated several of its TLS intermediate CA certificates with trivially small private keys, which have since been recovered and publicly disclosed. Those intermediates are signed by the "emSign ECC Root CA - G3" root certificate, which this port installs as part of its trusted bundle up to and including version 3.131. NSS 3.131.1 removes the root certificate. The intermediates have been …
Affected versions
- ca_root_nss < 3.131.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/ca_root_nss | 3.108 | vulnerable since 2026-10-23 | |
| MidnightBSD | security/ca_root_nss | 3.131.1 | out of range, by version | |
| FreeBSD | security/ca_root_nss | 3.132 | fixed |