eMudhra Intermediate CA Compromise
Key points
Gentoo reports that the private keys of eight eMudhra intermediate CA certificates were disclosed as compromised on 2026-10-20. Anyone holding those keys can issue forged certificates that affected software treats as fully trusted, which opens the door to man-in-the-middle attacks.
Risk to updates
- Self-update mechanisms that depend only on TLS verification are at risk: an attacker could compromise a system during an update attempt.
- A default Gentoo setup is protected. Ebuild repository syncs and binary package downloads are verified with OpenPGP keys, so Portage refuses tampered packages or metadata even if requests are intercepted.
What to do
- Upgrade to
>=app-misc/ca-certificates-20260816.3.125as the base fix. - Some packages ship their own bundled certificate stores and need separate fixes. Some refresh those certificates automatically; others have to be upgraded.
- Gentoo tracks the affected packages in bug 984601 and is pushing fixed versions to stable as quickly as possible.
- Under its unbundling policy, Gentoo is also looking at making more packages use the system certificate store.
Software outside Portage
- Software installed without the Gentoo package manager is affected too. For example, Python virtual environments with older versions of
certifi,piporuvare vulnerable. - Gentoo refers users to the Python upstream announcement for details and the recommended fix.
Summary by DistroNews, based on the original post.
On 2026-10-20, it has been disclosed that the private keys of eight eMudhra intermediate CA certificates have been compromised. These keys can be used to issue forged CA certificates that would be considered fully trusted by the affected software, and therefore could be used to perform man-in-the-middle attacks. Importantly, the vulnerability can also affect software self-update processes that use TLS verification as the only security measure, with an attempt to upgrade the system leading to it being compromised. The standard Gentoo configuration mitigates this risk, as both the ebuild repository updates and binary package downloads are secured using OpenPGP keys. A malicious third party may be able to intercept update requests, but Portage will reject any tampered packages or metadata. The baseline remediation is to upgrade to >=app-misc/ca-certificates-20260816.3.125. However, some packages are using bundled certificate stores and require separate remediation. In some cases the bundled certificates are updated automatically, in other the relevant packages will need to be upgraded. We are actively tracking the affected packages in bug 984601, and releasing fixed versions to Gentoo stable ASAP. We are also looking into forcing the use of the system certificate store in more packages, per out unbundling policy. Please note that packages installed outside Gentoo package manager are also affected. For example, Python virtual environments featuring the prior versions of certifi, pip or uv packages are vulnerable. Please refer to the Python upstream announcement for more details and the recommended remediation.
This is the summary Gentoo Linux News published with the story. The full text is on the original page.
Read the original at gentoo.org