Repository navigation
Update packages affected by the eMudhra CA compromise #1481
Description
The compromise of eight eMudhra intermediate CA private keys could allow attackers to forge trusted TLS certificates.
Identify and update affected packages in openRuyi to their patched versions to mitigate the security risk.
Progress
- ca-certificates: Unaffected.
- ca-certificates-mozilla: SPECS: ca-certificates-mozilla: Update to 2.92. [security-fixes] #1483
- nss: SPECS: nss: Update to 3.131.1. [security-fixes] #1478
- curl: Uses
ca-certificates-mozilla, needs rebuild once PR merged. - go: SPECS: go: Update to 1.27.3. [security-fixes] #1473
- nodejs: SPECS: nodejs: Update to 24.22.1. [security-fixes] #1485
- python-certifi: SPECS: python-certifi: Update to 2026.10.19. [security-fixes] #1474
- python-pip: SPECS: python-pip: Update to 26.2.2. [security-fixes] #1482
- python-uv: We don't have this package.
python-uv-buildis not affected. - rust-rustls-webpki-0.103: SPECS: rust-rustls-webpki-0.103: Update to 0.103.16. [security-fixes] #1475
- rust-webpki-roots-1: SPECS: rust-webpki-roots-1: Update to 1.0.10. [security-fixes] #1476
- rust-webpki-root-certs-1: SPECS: rust-webpki-root-certs-1: Update to 1.0.10. [security-fixes] #1477
- rustup: rustup: Update to 1.29.2. [security-fixes] #1487
- perl-Mozilla-CA: SPECS: perl-Mozilla-CA: Update to 20261020. [security-fixes] #1480, in the future uses
ca-certificates-mozilla - python: SPECS: python: Update to 3.14.9. [security-fixes] #1498
- openjdk-17: SPECS: openjdk-17: Update to 17.0.21.9 [security-fixes] #1502
- openjdk-21: SPECS: openjdk-21: Update to 21.0.13.9 [security-fixes] #1503
- openjdk-25: SPECS: openjdk-25: Update to 25.0.5.8 [security-fixes] #1501
- openjdk-latest: SPECS: openjdk-latest: Update to 27.0.1.0.2.1 [security-fixes] #1500
- moby: Update some packages and fix CVE #1472
- docker-cli: SPECS: docker-cli: Update to 29.9.2. #1515
Activity
yinjiayi commentedon Oct 22, 2026
Thanks for reporting! We've received this issue and will follow up soon. If possible, please share reproduction steps, logs, or environment details to help us look into it faster.
misaka00251 commentedon Oct 22, 2026
We might also need to update our various OpenJDK builds. @DingliZhang
DingliZhang commentedon Oct 22, 2026
@misaka00251 Thanks for the heads-up! I've opened update PRs for OpenJDK 17 (#1502), 21 (#1503), 25 (#1501), and openjdk-latest (#1500). They are awaiting review.