eMudhra Compromise Risks Bundled Cert Stores in Rust, NixOS, and TeX Live

The recent compromise of an eMudhra certificate has exposed risks for software that bundles its own root certificate stores. Security researcher Hanno Böck identified affected files in TeX Live and Nmap installations, noting that bundled stores are potentially vulnerable.

What happened

Hanno Böck posted an advisory to the oss-security mailing list on October 20, highlighting that the eMudhra certificate compromise affects any software bundling its own root certificate store. He identified the affected "Comodo AAA Services" certificate in a file within the texlive-core package on Gentoo systems. This file originates from the upstream texlive-infra package.

On October 21, LN Liberda added that certain Rust codebases include certificate stores inside their binaries via the webpki-root-certs or webpki-roots crates. This includes applications like uv and deno, which use these stores unless specific environment variables are set to override them. An SBOM check on Alpine Linux edge found potentially affected packages in community and testing repositories.

Hanno Böck followed up on October 21, noting that many more applications have bundled stores. NixOS developers have collected lists of affected packages in GitHub issues, covering vendored PEM bundles, bundles inside wheels or jars, Java keystores, and compiled-in certificates.

Why it matters

Software that bundles its own root certificate store does not rely on the operating system's trust store. This means that even if a system administrator revokes the eMudhra certificate in the OS store, the bundled application may still trust it. This creates a persistent risk of man-in-the-middle attacks or unauthorized access for users of these applications.

The scope of affected software is broad, including popular tools like uv and deno, as well as infrastructure components like TeX Live. The presence of the compromised certificate in bundled stores means that users of these applications are exposed to the risk regardless of their system-level security configurations.

What to watch

• Monitor vendor announcements for patches or updates to remove the compromised certificate from bundled stores.
• Check environment variables for applications like uv and deno to ensure they are not using bundled stores if possible.
• Review SBOMs and package lists for affected software in your environment, especially for Rust-based applications.
• Watch for updates from NixOS and Alpine Linux regarding affected packages in their repositories.

Who needs to act first

Teams should prioritize systems exposed to external networks or handling sensitive data. Identify applications using bundled certificate stores, such as Rust binaries or NixOS packages. Test any configuration changes in isolated environments before widespread deployment. Back up current configurations to allow for rollback if issues arise. Reduce exposure by restricting network access for affected systems until a fix is available. Verify that environment variables are set to use system trust stores where possible. Communicate with vendors for status updates on remediation efforts.

What to do and how to stay safe: eMudhra

• Audit your environment for software that bundles its own root certificate store, including Rust applications and NixOS packages.
• Check if applications like uv or deno are configured to use bundled stores and adjust environment variables to use system stores if possible.
• Monitor vendor communications for patches or updates to remove the compromised eMudhra certificate from bundled stores.
• Restrict network access for systems running affected software until a fix is confirmed and deployed.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific software packages are affected by the eMudhra certificate compromise?

Affected packages include TeX Live (specifically texlive-infra), Nmap/ncat, Rust applications using webpki-root-certs or webpki-roots crates (like uv and deno), and various NixOS and Alpine Linux packages.

Is there a patch available to fix the bundled certificate store issue?

No patch or update has been confirmed yet by the vendors to remove the compromised certificate from the bundled stores.

How can I check if my Rust application is affected?

Check if your Rust application uses the webpki-root-certs or webpki-roots crates, which include bundled certificate stores. Applications like uv and deno are known to use these unless configured otherwise.