DEBIAN-CVE-2026-113812

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-113812

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113812.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113812

Upstream

CVE-2026-113812

Published

2026-10-21T05:47:31Z

Modified

2026-10-21T06:05:48Z

Summary

[none]

Details

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

References

https://security-tracker.debian.org/tracker/CVE-2026-113812

Affected packages

Debian:13 / libmozilla-ca-perl

Package

Name: libmozilla-ca-perl
Purl: pkg:deb/debian/libmozilla-ca-perl?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

Other

20250202-1

20260813-1

Ecosystem specific

{
    "urgency":  "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113812.json"

Debian:14 / libmozilla-ca-perl