Dear deepin users and community partners,
Recently, the private keys of 8 intermediate CA certificates from the public CA organization eMudhra were confirmed to be compromised. The flaw stems from an implementation error when the CA generated keys — the private key can be recovered directly from the certificate itself. Anyone who obtains it can issue 'legitimate' TLS certificates and code-signing certificates for arbitrary domains, and these certificates chain to root certificates jointly trusted by mainstream browsers and operating systems.
This update involves only one software package, 'ca-certificates'. Please upgrade as soon as possible.
Vulnerability Details
Vulnerability ID: CVE-2026-111943
Description: Of the 8 affected intermediate certificates, 6 are TLS issuing certificates (DV / OV / EV TLS CA - G3B, G3C), chained to 'emSign Root TLS CA - G3'; 2 are code-signing certificates (EM OV CS CA - G3B, G3C), chained to 'emSign Root CS CA - G3'. In addition, there are cross-signed copies issued by Sectigo and chained to 'AAA Certificate Services'.
Impact: An attacker holding these private keys, if positioned as a network man-in-the-middle, can conduct man-in-the-middle attacks against clients that do not check certificate revocation status — forging arbitrary websites and stealing or tampering with communications. Because these intermediate certificates have no records in Certificate Transparency (CT) logs, browsers that enforce CT validation (Chrome, Edge, Firefox, Safari) are not affected; however, components that use the system trust store, such as curl, wget, git, pip, apt, cannot learn the revocation information and will continue to trust these certificates. This must be fixed through this update.
Severity: Critical (CVSS 9.1)
Scope of Impact
All deepin 25 users who have not updated with this fix. It is recommended to update and upgrade immediately.
Fix Progress
deepin 25:
'ca-certificates' has been upgraded to 20250419+deb13u1, following the Debian Security Team’s approach (Debian Bug 1151413): removing the two affected root certificates, 'emSign ECC Root CA - G3' and 'Comodo AAA Services root', from the system trust store, thereby cutting off the trust chains for the above 8 intermediate certificates and their cross-signed copies.
Please update via Control Center, or use the terminal command upgrade:
sudo apt update && sudo apt dist-upgrade
This update does not require a system reboot. Restart running programs to load the updated trust store.
Note: Removing root certificates will also affect other normally issued certificates under those root certificates. Some sites may experience certificate validation failures. This is expected behavior and is consistent with the upstream handling by Debian, Mozilla NSS, and others.
That’s all for this update. Once again, thank you to every deepin community friend for your support!
No replies yet
Featured Collection
Popular Ranking
Popular Events
中文 
List of bugs and suggestions 
Dear deepin users and community partners,
Recently, the private keys of 8 intermediate CA certificates from the public CA organization eMudhra were confirmed to be compromised. The flaw stems from an implementation error when the CA generated keys — the private key can be recovered directly from the certificate itself. Anyone who obtains it can issue 'legitimate' TLS certificates and code-signing certificates for arbitrary domains, and these certificates chain to root certificates jointly trusted by mainstream browsers and operating systems.
This update involves only one software package, 'ca-certificates'. Please upgrade as soon as possible.
Vulnerability Details
Vulnerability ID: CVE-2026-111943
Description: Of the 8 affected intermediate certificates, 6 are TLS issuing certificates (DV / OV / EV TLS CA - G3B, G3C), chained to 'emSign Root TLS CA - G3'; 2 are code-signing certificates (EM OV CS CA - G3B, G3C), chained to 'emSign Root CS CA - G3'. In addition, there are cross-signed copies issued by Sectigo and chained to 'AAA Certificate Services'.
Impact: An attacker holding these private keys, if positioned as a network man-in-the-middle, can conduct man-in-the-middle attacks against clients that do not check certificate revocation status — forging arbitrary websites and stealing or tampering with communications. Because these intermediate certificates have no records in Certificate Transparency (CT) logs, browsers that enforce CT validation (Chrome, Edge, Firefox, Safari) are not affected; however, components that use the system trust store, such as curl, wget, git, pip, apt, cannot learn the revocation information and will continue to trust these certificates. This must be fixed through this update.
Severity: Critical (CVSS 9.1)
Scope of Impact
All deepin 25 users who have not updated with this fix. It is recommended to update and upgrade immediately.
Fix Progress
deepin 25:
'ca-certificates' has been upgraded to 20250419+deb13u1, following the Debian Security Team’s approach (Debian Bug 1151413): removing the two affected root certificates, 'emSign ECC Root CA - G3' and 'Comodo AAA Services root', from the system trust store, thereby cutting off the trust chains for the above 8 intermediate certificates and their cross-signed copies.
Please update via Control Center, or use the terminal command upgrade:
sudo apt update && sudo apt dist-upgrade
This update does not require a system reboot. Restart running programs to load the updated trust store.
Note: Removing root certificates will also affect other normally issued certificates under those root certificates. Some sites may experience certificate validation failures. This is expected behavior and is consistent with the upstream handling by Debian, Mozilla NSS, and others.
That’s all for this update. Once again, thank you to every deepin community friend for your support!