#cve_2026_111943 — Public Fediverse posts

Mitigating CVE-2026-111943 on #Debian:

- sudo dpkg-reconfigure ca-certificates
- Select "ask" and deselect the following entries:
mozilla/emSign_ECC_Root_CA_-_C3.crt
mozilla/emSign_ECC_Root_CA_-_G3.crt
mozilla/emSign_Root_CA_-_C1.crt
mozilla/emSign_Root_CA_-_G1.crt
- Hit <Ok>

Alternatively you can edit /etc/ca-certificates.conf manually and add the specific entries:

!mozilla/emSign_ECC_Root_CA_-_C3.crt
!mozilla/emSign_ECC_Root_CA_-_G3.crt
!mozilla/emSign_Root_CA_-_C1.crt
!mozilla/emSign_Root_CA_-_G1.crt

...and sudo update-ca-certificates

#CVE_2026_111943

Mitigating CVE-2026-111943 on macOS:

- Launch KeyChain Access and remove trust for "emSign *" roots in System Keychains/System Roots
- Edit /etc/ssl/cert.pem and remove all eMudhra certificates.

NOTE: Some applications may still include their own, embedded ca-bundle files.

#CVE_2026_111943

New Go security releases added explicit distrust for some specific intermediate CA certificates belonging to eMudhra Technologies Limited. Interestingly, this is tracked as CVE-2026-111943 but no details on why this was done are provided.

https://github.com/golang/go/commit/7f86f957633ee31a1c17a1eb8452ca7a3d9bc141

#pki #CVE_2026_111943 #infosec #cybersecurity