{"id":"CVE-2026-113470","kind":"vulnerability","aliases":["CVE-2026-113470"],"related":[],"title":"Firefox: cryptographic flaw in block-list and allow-list state component","description":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\n### CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\nBulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT\n\nSummary:\n\nAWS-owned TLS trust bundles are certificate stores used by AWS services to validate outbound TLS connections to customer-configured endpoints, including identity provider endpoints, origin servers, and webhook destinations. We identified CVE-2026-111943, a cryptographic key-generation issue affecting an external Certificate Authority (eMudhra/emSign), whose intermediate CA private keys were trivially recoverable due to catastrophic entropy failures in P-384 key generation. Eight intermediate CA private keys (six TLS, two code-signing) were generated with scalar values of small integers, making them mathematically recoverable without specialized tooling. Please note, customers whose TLS clients enforce certificate revocation checking (OCSP or CRL fail-closed) are not affected, as the issuing CA revoked the affected intermediates on 2026-10-18, and the cross-signing CA revoked its copies on 2026-10-19.\n\nAffected roots:\n\n- AAA Certificate Services (SPKI SHA-256: bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3)\n- emSign Root TLS CA – G3 (SPKI SHA-256: c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9)\n- emSign ECC Root CA – G3 (SPKI SHA-256: 8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)\n\nCurrent Mitigation Status:\n\n- Root removal changes for the shared AWS trust store were merged and deployed to the live version set on 2026-10-21.\n- AWS SDK for Python (boto3 / botocore) was updated and released to PyPI as version 1.43.117.\n- Amazon CloudFront is deploying root removal from the edge CA bundle by the target date of 2026-10-28.\n- Amazon Linux 2 and Amazon Linux 2023 updates are available now. Customers should update the ca-certificates package: sudo yum update ca-certificates. Please follow ALAS CVE-2026-113470 and CVE-2026-111943 for more details.\n- Amazon Corretto has released updated JDK versions across all supported lines with the affected roots removed.\n- Bottlerocket is publishing updated AMIs targeted for 2026-10-26, with the latest AMI parameters updated in commercial regions by 2026-10-28.\n- Application Load Balancer is removing the affected roots from the trust store used to validate identity provider endpoints for OIDC and JWT authentication. Application Load Balancers with OIDC or JWT authentication enabled are being updated between 2026-10-29 and 2026-10-31, and newly created Application Load Balancers are protected by 2026-11-02. Customers using OIDC or JWT authentication on Application Load Balancers are being notified through AWS Health. If an identity provider certificate chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.\n- AWS Security Token Service (STS) and Amazon Cognito have completed deploying trust store updates, removing the affected roots used to validate outbound TLS connections to identity provider endpoints.\n- RDS for SQL Server is updating managed hosts to remove the affected roots, targeted for 2026-10-30. No customer action is required.\n- EMR is releasing updated versions targeted for 2026-10-31. Customers should update when available.\n\nMitigation Guidance:\n\n- Amazon CloudFront: Customers whose origin server certificates chain to one of the three affected roots may experience TLS validation failures as AWS removes the roots from the CloudFront edge CA bundle. Impacted customers have been notified through their Personal Health Dashboard. \n- Elastic Load Balancing (Application Load Balancer): AWS is notifying customers whose Application Load Balancers use OIDC or JWT authentication through AWS Health. If your identity provider endpoint presents a certificate that chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28. \n- Amazon Corretto: Customers should upgrade to the latest versions, which are now available for download. \n- Amazon Linux 2 and Amazon Linux 2023: Update for ca-certificates package is available now: sudo yum update ca-certificates \n- AWS SDK for Python (boto3 / botocore): AWS SDK for Python (boto3 / botocore): Update to botocore version 1.43.117 or later. \n- Bottlerocket: Customers running Bottlerocket-based workloads on Amazon Elastic Kubernetes Service (EKS) or Amazon Elastic Container Service (ECS) on AMI versions at or below v1.67.0 are affected until updated AMIs are available. Customers should apply the interim per-node trust override using the Bottlerocket API:\n\n## Interim per-node trust override\n\n```\napiclient apply <<'EOF'\n# emSign ECC Root CA - C3 (O=eMudhra Inc)\n# SHA-256 BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3\n[settings.pki.emsign-ecc-c3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNLekNDQWJHZ0F3SUJBZ0lLZTNHMmdsYTRFbnljcURBS0JnZ3Foa2pPUFFRREF6QmFNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVVTUJJR0ExVUVDaE1MWlUxMVpHaHlZU0JKYm1NeElEQWVCZ05WQkFNVEYyVnRVMmxuYmlCRgpRME1nVW05dmRDQkRRU0F0SUVNek1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93V2pFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNU0F3SGdZRFZRUUQKRXhkbGJWTnBaMjRnUlVORElGSnZiM1FnUTBFZ0xTQkRNekIyTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQTJJQUJQMmxZYTU3SmhBZAo2YmNpTUs0RzlJR3pzVUp4bFRtODAxTGpyNi81OHBjMWtqWkdEb2VWamJrNVd1bTczOUQreUFkQlBMdFZiNE9qYXZ0aXNJR0pBbkI5ClNNVks0K2tpVkNKTms3dENESzkzbkNPbWZkZGhFYzVseC9oLy92WHlxYU5DTUVBd0hRWURWUjBPQkJZRUZQdGFTTkNBSUVEeXFPa0EKQjJrWmQ2Zm13L1RQTUE0R0ExVWREd0VCL3dRRUF3SUJCakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQW9HQ0NxR1NNNDlCQU1EQTJnQQpNR1VDTVFDMDJDOENpZjIyVEdLNlEwNFRoSEsxcnQwYzN0YTEzRmFQV0VCYUxkNGdUQ0tEeXBPb2Z1NFNRTWZXaDAvNDM0VUNNQndVClpPUjhsb01SbkxEUldtRkxwZzlKMHdEOG9memtwZjkvcmRjdzBNZDNmNzZCQjFVd1VDQVU5VmM0Q3FneFVRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign ECC Root CA - G3 (O=eMudhra Technologies Limited)\n# SHA-256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B\n[settings.pki.emsign-ecc-g3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNUakNDQWRPZ0F3SUJBZ0lLUFBZSHFXaHdEdHFMaERBS0JnZ3Foa2pPUFFRREF6QnJNUXN3Q1FZRFZRUUdFd0pKVGpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVsTUNNR0ExVUVDaE1jWlUxMVpHaHlZU0JVWldOb2JtOXNiMmRwWlhNZ1RHbHRhWFJsWkRFZwpNQjRHQTFVRUF4TVhaVzFUYVdkdUlFVkRReUJTYjI5MElFTkJJQzBnUnpNd0hoY05NVGd3TWpFNE1UZ3pNREF3V2hjTk5ETXdNakU0Ck1UZ3pNREF3V2pCck1Rc3dDUVlEVlFRR0V3SkpUakVUTUJFR0ExVUVDeE1LWlcxVGFXZHVJRkJMU1RFbE1DTUdBMVVFQ2hNY1pVMTEKWkdoeVlTQlVaV05vYm05c2IyZHBaWE1nVEdsdGFYUmxaREVnTUI0R0ExVUVBeE1YWlcxVGFXZHVJRVZEUXlCU2IyOTBJRU5CSUMwZwpSek13ZGpBUUJnY3Foa2pPUFFJQkJnVXJnUVFBSWdOaUFBUWpwUXk0TFJMMUtQT3hzdDNpQWhLQW5qbGZTVTJmeVNVMFdYVHN1d1ljCjU4QnlyK2l1TCtGQlZJY1VxRXF5Nkh5QzVsdHF0ZHl6ZGM2TEJ0Q0dJNzlHMVk0UFB3VDAxeHlTZnZhbFk4TDFYNDR1VDZFWUdRSXIKTWdxQ1pIMFdrOUdqUWpCQU1CMEdBMVVkRGdRV0JCUjhYUUtFRTlUTWlwdUJ6aGNjTGlrZW5FaGpRakFPQmdOVkhROEJBZjhFQkFNQwpBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFLQmdncWhrak9QUVFEQXdOcEFEQm1BakVBdnZOaHp3SVFIV1NWQjdnWWJvaUZCUytECkNCZVF5aCtLVE9nTkczcXhyZFdCQ1Vmdk82d0lCSHhjbWJIdFJ3ZlNBakVBbmJwVi9LbEs2TzN0NW5ZQlFudkkrR0RaalZHTFZUdjcKakh2clpRbkQrSmJOUjZpQzhoWlZkeVIrRWhDVkJDeWoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign Root CA - C1 (O=eMudhra Inc)\n# SHA-256 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F\n[settings.pki.emsign-root-c1]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURjekNDQWx1Z0F3SUJBZ0lMQUs3UEFMckV6ekw0UTdJd0RRWUpLb1pJaHZjTkFRRUxCUUF3VmpFTE1Ba0dBMVVFQmhNQ1ZWTXgKRXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUURFeE5sYlZOcApaMjRnVW05dmRDQkRRU0F0SUVNeE1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93VmpFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUUQKRXhObGJWTnBaMjRnVW05dmRDQkRRU0F0SUVNeE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeit1cAp1ZkdaQmN6WUtDRks4M00wVVlSV0VQV2dUeXdTNC9vVG1pZlF6L2w1R25SZkhYazUvRnY0Y0k3Z2tsTDM1Q1g1VklQWkhkUElXb1UvClhzZTJCKzQrd002YXI2eFdRaW81SlhEV3Y3VjdOcTJzOW5QY3pkY2Rpb09sK3l1UUZUZHJIQ1pIM0RzcFZwTnFzOEZxT3AwOTljR1gKT0ZnRml4d1I0K1MwdUYyRkhZUCtlRjhMUldnWVNLVkdjelE3L2cvSWRydkhHUE1GMFliemhlM251ZGt5clZXSXpxYTJrYkJQckg0VgpJNWIyUC9BZ05CYmVDc2JFQkVWNWY2Zjl2dEtwcGErY3hTTXE5endoYkwydmowN0ZPckx6TkJMODM0QWFTYVRVcVpYM25vbGVvb21zCmxNdW9hSnV2aW1VbnpZbnUzWXkxYXlsd1E2QnBDK1M1RHdJREFRQUJvMEl3UURBZEJnTlZIUTRFRmdRVS9xSGdjQjRxQXpsU1drSysKWEpHRmVoaXFUYlV3RGdZRFZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQU1KS1Z2b1ZJWHNvb3VubEhmdjRMY1E1bGtGTU95Y3N4R3dZRllER3JLOUhXUzhtQytNMnNPODcva09YU1RLWkVoVmIzeEVwCi82dFQrTHZCZUErc25GT3ZWNzFvakQxcE0vQ2pvQ05qTzJSbklrU3QxWEhMVmlwNGtxTlBFakUyTnVMZS9nREVvMkFQSjYyZ3NJcTEKTm5wU29iMG45Q0FuWXVoTmxDUVQ1QW9FNlR5ckxzaERDVXJHWVFUbFNUUiswOFRJOVEvQXF1bTZWRjd6WXl0UFQxRFUvcmw3bVl3OQp3QzY4QWl2VHhFRGtpZ2N4SHB2T0pwa1QreEhxbWlJTUVSbkhYaHVCVURESWxoSnU1OHRCZjVFN29rZTNWSUFiM0FETW1wRHF3OE5RCkJtSU1NTUFWU0tlb1dYemhyaUtpNGdwNkQvcGlxMUpNNGZIZnlyNkREVUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\"\nEOF\n```\n\nReferences:\n\n- CVE-2026-111943\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"A cryptographic weakness in the Security Block-lists, Allow-lists and other State component of Firefox and Thunderbird was fixed in several releases. The sources do not describe what an attacker can read or forge through it.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","desktop","firefox","lab-disclosure","runtime","thunderbird"],"not_affected_if":["current-release"],"how_to_check":"- Check the installed Firefox version (`firefox --version`) and compare it with the fixed releases.\n- Check the installed Thunderbird version (`thunderbird --version`) and compare it with the fixed releases.","fix":"- Update Firefox to `158.0.2`, `158.0.1`, `153.5.1` (ESR) or `115.43.1` (ESR), matching your branch.\n- Update Thunderbird to `158.0.1` or `153.5.1`.","status":"open","published_at":"2026-10-20T13:16:41+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:16:35+00:00","updated_at":"2026-10-25T04:26:14+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:16:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `158.0.2`, `158.0.1`, `153.5.1` (ESR) or `115.43.1` (ESR), matching your branch.\n- Update Thunderbird to `158.0.1` or `153.5.1`.","reach":"unknown","title":"Firefox: cryptographic flaw in block-list and allow-list state component","impact":"medium","summary":"A cryptographic weakness in the Security Block-lists, Allow-lists and other State component of Firefox and Thunderbird was fixed in several releases. The sources do not describe what an attacker can read or forge through it.","category":"runtime","nicknames":[],"who_cares":["firefox","thunderbird","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact","analyst_note":"Find the Mozilla advisory for the exact impact and attack path; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113470 gives only the title.","how_to_check":"- Check the installed Firefox version (`firefox --version`) and compare it with the fixed releases.\n- Check the installed Thunderbird version (`thunderbird --version`) and compare it with the fixed releases.","needs_analyst":true,"not_affected_if":["current-release"],"who_is_affected":"Desktop users running Firefox or Thunderbird builds older than the listed fixed versions. The sources do not say whether managed or server-side deployments are affected. Teams that only run current releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3327,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-02':463C '-10':231C,244C,296C,330C,394C,407C,446C,450C,506C,552C,567C '-11':462C '-111943':67C,79C,145C,366C '-113470':16A,19A,362C '-150':92C '-18':232C '-19':245C '-2026':15A,18A,66C,78C,144C,361C,365C '-21':297C '-256':253C,262C,271C '-26':395C '-28':331C,408C,507C '-29':447C '-30':553C '-31':451C,568C '-384':173C '00':105C '1.43.117':312C '10/24/2026':103C '2':334C '20':104C '2023':338C '2026':91C,230C,243C,295C,329C,393C,406C,445C,449C,461C,505C,551C,566C '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782':272C 'aaa':248C 'across':377C 'action':556C 'affect':152C,220C,227C,246C,383C,415C,490C,524C,547C,589C,653C 'ala':359C 'allow':10A,38B 'allow-list':9A,37B 'amazon':313C,332C,336C,370C,514C,576C 'ami':390C,399C 'applic':409C,432C,455C,471C,620C,628C 'attack':60B 'attent':100C 'authent':431C,439C,469C,635C 'author':156C,503C 'avail':341C,573C 'aw':20B,74C,86C,93C,95C,110C,120C,282C,298C,478C,500C,508C,597C,623C,637C 'aws-own':109C 'aws-trust':499C 'balanc':411C,434C,457C,473C,619C,622C,630C 'bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3':254C 'block':6A,35B 'block-list':5A,34B 'boto3':302C 'botocor':303C 'bottlerocket':386C 'bulletin':89C 'bundl':76C,88C,114C,323C,606C 'c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9':263C 'ca':70C,82C,160C,178C,224C,238C,258C,267C,322C,348C,355C,605C 'ca-certif':347C,354C 'catastroph':168C 'certif':116C,155C,209C,249C,349C,356C,484C,496C,502C,582C,646C 'chain':485C,583C,648C 'chang':278C 'check':211C 'client':207C 'close':217C 'cloudfront':314C,577C,603C 'code':185C 'code-sign':184C 'cognito':515C 'commerci':403C 'complet':517C 'compon':13A,43B 'configur':130C 'connect':126C,531C 'content':96C 'copi':241C 'corretto':371C 'creat':454C 'crl':214C 'cross':236C 'cross-sign':235C 'cryptograph':2A,29B,147C 'current':273C 'custom':129C,204C,343C,464C,555C,569C,578C,608C,626C 'customer-configur':128C 'cve':14A,17A,65C,77C,143C,360C,364C 'dashboard':616C 'date':102C,327C 'deploy':288C,316C,518C 'describ':57B 'desktop':21B 'destin':140C 'detail':369C 'disclosur':25B 'due':166C 'ecc':265C 'edg':321C,604C 'eight':176C 'elast':617C 'emr':559C 'emsign':255C,264C 'emudhra':68C,80C 'emudhra/emsign':157C 'enabl':440C 'endpoint':131C,135C,426C,535C,643C 'enforc':208C 'entropi':169C 'experi':592C 'extern':154C 'fail':216C 'fail-clos':215C 'failur':170C,595C 'firefox':1A,22B,45B 'fix':49B 'flaw':3A 'follow':358C 'forg':64B 'g3':259C,268C 'generat':150C,175C,188C 'guidanc':575C 'health':479C,615C,638C 'host':543C 'id':90C 'ident':133C,424C,482C,533C,641C 'identifi':142C 'impact':607C 'import':98C 'includ':132C 'integ':194C 'intermedi':69C,81C,159C,177C,228C 'issu':151C,223C 'jdk':375C 'jwt':430C,438C,468C,634C 'key':71C,83C,149C,162C,174C,180C 'key-gener':148C 'lab':24B 'lab-disclosur':23B 'latest':398C 'line':380C 'linux':333C,337C 'list':7A,11A,36B,39B 'live':291C 'load':410C,433C,456C,472C,618C,621C,629C 'make':195C 'manag':542C 'mathemat':197C 'may':591C 'merg':286C 'mitig':274C,574C 'newli':453C 'note':203C 'notifi':476C,611C,625C 'ocsp':212C 'oidc':428C,436C,466C,632C 'one':487C,585C,650C 'origin':136C,580C 'outbound':124C,529C 'own':111C 'p':172C 'packag':350C 'paramet':400C 'pdt':107C 'person':614C 'pleas':202C,357C 'pm':106C 'present':644C 'privat':161C,179C 'protect':459C 'provid':134C,425C,483C,534C,642C 'public':101C 'publish':388C 'pypi':309C 'python':301C 'rds':536C 'read':62B 'recover':165C,198C 'recoveri':72C,84C 'region':404C 'releas':52B,307C,373C,561C 'remov':277C,318C,385C,413C,522C,545C,598C 'replac':492C 'requir':99C,558C 'revoc':210C 'revok':225C,239C 'roo':654C 'root':247C,256C,266C,276C,317C,384C,416C,491C,525C,548C,590C,600C 'runtim':26B 'scalar':190C 'scope':94C 'sdk':299C 'secur':33B,509C 'server':137C,539C,581C 'servic':121C,250C,511C 'set':293C 'sever':51B 'sha':252C,261C,270C 'share':281C 'sign':186C,237C 'six':181C 'small':193C 'sourc':54B 'special':200C 'spki':251C,260C,269C 'sql':538C 'state':12A,42B 'status':275C 'store':117C,284C,420C,520C 'sts':512C 'sudo':351C 'summari':108C 'support':379C 'target':326C,391C,549C,564C 'three':588C 'thunderbird':27B,47B 'tls':112C,125C,182C,206C,257C,530C,593C 'token':510C 'tool':201C 'trivial':164C 'trust':75C,87C,113C,283C,419C,501C,519C 'two':183C 'type':97C 'updat':305C,339C,345C,353C,374C,389C,401C,443C,521C,541C,562C,571C 'use':118C,421C,465C,526C,631C 'valid':123C,423C,528C,594C 'valu':191C 'version':292C,311C,376C,563C 'weak':30B 'webhook':139C 'whose':158C,205C,579C,627C 'without':199C 'yum':352C","nicknames":[],"mitigations":[],"who_affected":"Desktop users running Firefox or Thunderbird builds older than the listed fixed versions. The sources do not say whether managed or server-side deployments are affected. Teams that only run current releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113470","severity":null,"published_at":"2026-10-20T13:16:41+00:00","modified_at":"2026-10-21T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/#CVE-2026-113470","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","severity":null,"published_at":"2026-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-25T04:26:14+00:00","fetched_at":"2026-10-25T04:26:14+00:00","note":"AWS: CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles"}],"documents":[{"id":3393,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","title":"AWS: CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","kind":"advisory","source":"lab","text":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\n### CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\nBulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT\n\nSummary:\n\nAWS-owned TLS trust bundles are certificate stores used by AWS services to validate outbound TLS connections to customer-configured endpoints, including identity provider endpoints, origin servers, and webhook destinations. We identified CVE-2026-111943, a cryptographic key-generation issue affecting an external Certificate Authority (eMudhra/emSign), whose intermediate CA private keys were trivially recoverable due to catastrophic entropy failures in P-384 key generation. Eight intermediate CA private keys (six TLS, two code-signing) were generated with scalar values of small integers, making them mathematically recoverable without specialized tooling. Please note, customers whose TLS clients enforce certificate revocation checking (OCSP or CRL fail-closed) are not affected, as the issuing CA revoked the affected intermediates on 2026-10-18, and the cross-signing CA revoked its copies on 2026-10-19.\n\nAffected roots:\n\n- AAA Certificate Services (SPKI SHA-256: bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3)\n- emSign Root TLS CA – G3 (SPKI SHA-256: c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9)\n- emSign ECC Root CA – G3 (SPKI SHA-256: 8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)\n\nCurrent Mitigation Status:\n\n- Root removal changes for the shared AWS trust store were merged and deployed to the live version set on 2026-10-21.\n- AWS SDK for Python (boto3 / botocore) was updated and released to PyPI as version 1.43.117.\n- Amazon CloudFront is deploying root removal from the edge CA bundle by the target date of 2026-10-28.\n- Amazon Linux 2 and Amazon Linux 2023 updates are available now. Customers should update the ca-certificates package: sudo yum update ca-certificates. Please follow ALAS CVE-2026-113470 and CVE-2026-111943 for more details.\n- Amazon Corretto has released updated JDK versions across all supported lines with the affected roots removed.\n- Bottlerocket is publishing updated AMIs targeted for 2026-10-26, with the latest AMI parameters updated in commercial regions by 2026-10-28.\n- Application Load Balancer is removing the affected roots from the trust store used to validate identity provider endpoints for OIDC and JWT authentication. Application Load Balancers with OIDC or JWT authentication enabled are being updated between 2026-10-29 and 2026-10-31, and newly created Application Load Balancers are protected by 2026-11-02. Customers using OIDC or JWT authentication on Application Load Balancers are being notified through AWS Health. If an identity provider certificate chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.\n- AWS Security Token Service (STS) and Amazon Cognito have completed deploying trust store updates, removing the affected roots used to validate outbound TLS connections to identity provider endpoints.\n- RDS for SQL Server is updating managed hosts to remove the affected roots, targeted for 2026-10-30. No customer action is required.\n- EMR is releasing updated versions targeted for 2026-10-31. Customers should update when available.\n\nMitigation Guidance:\n\n- Amazon CloudFront: Customers whose origin server certificates chain to one of the three affected roots may experience TLS validation failures as AWS removes the roots from the CloudFront edge CA bundle. Impacted customers have been notified through their Personal Health Dashboard. \n- Elastic Load Balancing (Application Load Balancer): AWS is notifying customers whose Application Load Balancers use OIDC or JWT authentication through AWS Health. If your identity provider endpoint presents a certificate that chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28. \n- Amazon Corretto: Customers should upgrade to the latest versions, which are now available for download. \n- Amazon Linux 2 and Amazon Linux 2023: Update for ca-certificates package is available now: sudo yum update ca-certificates \n- AWS SDK for Python (boto3 / botocore): AWS SDK for Python (boto3 / botocore): Update to botocore version 1.43.117 or later. \n- Bottlerocket: Customers running Bottlerocket-based workloads on Amazon Elastic Kubernetes Service (EKS) or Amazon Elastic Container Service (ECS) on AMI versions at or below v1.67.0 are affected until updated AMIs are available. Customers should apply the interim per-node trust override using the Bottlerocket API:\n\n## Interim per-node trust override\n\n```\napiclient apply <<'EOF'\n# emSign ECC Root CA - C3 (O=eMudhra Inc)\n# SHA-256 BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3\n[settings.pki.emsign-ecc-c3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNLekNDQWJHZ0F3SUJBZ0lLZTNHMmdsYTRFbnljcURBS0JnZ3Foa2pPUFFRREF6QmFNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVVTUJJR0ExVUVDaE1MWlUxMVpHaHlZU0JKYm1NeElEQWVCZ05WQkFNVEYyVnRVMmxuYmlCRgpRME1nVW05dmRDQkRRU0F0SUVNek1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93V2pFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNU0F3SGdZRFZRUUQKRXhkbGJWTnBaMjRnUlVORElGSnZiM1FnUTBFZ0xTQkRNekIyTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQTJJQUJQMmxZYTU3SmhBZAo2YmNpTUs0RzlJR3pzVUp4bFRtODAxTGpyNi81OHBjMWtqWkdEb2VWamJrNVd1bTczOUQreUFkQlBMdFZiNE9qYXZ0aXNJR0pBbkI5ClNNVks0K2tpVkNKTms3dENESzkzbkNPbWZkZGhFYzVseC9oLy92WHlxYU5DTUVBd0hRWURWUjBPQkJZRUZQdGFTTkNBSUVEeXFPa0EKQjJrWmQ2Zm13L1RQTUE0R0ExVWREd0VCL3dRRUF3SUJCakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQW9HQ0NxR1NNNDlCQU1EQTJnQQpNR1VDTVFDMDJDOENpZjIyVEdLNlEwNFRoSEsxcnQwYzN0YTEzRmFQV0VCYUxkNGdUQ0tEeXBPb2Z1NFNRTWZXaDAvNDM0VUNNQndVClpPUjhsb01SbkxEUldtRkxwZzlKMHdEOG9memtwZjkvcmRjdzBNZDNmNzZCQjFVd1VDQVU5VmM0Q3FneFVRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign ECC Root CA - G3 (O=eMudhra Technologies Limited)\n# SHA-256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B\n[settings.pki.emsign-ecc-g3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNUakNDQWRPZ0F3SUJBZ0lLUFBZSHFXaHdEdHFMaERBS0JnZ3Foa2pPUFFRREF6QnJNUXN3Q1FZRFZRUUdFd0pKVGpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVsTUNNR0ExVUVDaE1jWlUxMVpHaHlZU0JVWldOb2JtOXNiMmRwWlhNZ1RHbHRhWFJsWkRFZwpNQjRHQTFVRUF4TVhaVzFUYVdkdUlFVkRReUJTYjI5MElFTkJJQzBnUnpNd0hoY05NVGd3TWpFNE1UZ3pNREF3V2hjTk5ETXdNakU0Ck1UZ3pNREF3V2pCck1Rc3dDUVlEVlFRR0V3SkpUakVUTUJFR0ExVUVDeE1LWlcxVGFXZHVJRkJMU1RFbE1DTUdBMVVFQ2hNY1pVMTEKWkdoeVlTQlVaV05vYm05c2IyZHBaWE1nVEdsdGFYUmxaREVnTUI0R0ExVUVBeE1YWlcxVGFXZHVJRVZEUXlCU2IyOTBJRU5CSUMwZwpSek13ZGpBUUJnY3Foa2pPUFFJQkJnVXJnUVFBSWdOaUFBUWpwUXk0TFJMMUtQT3hzdDNpQWhLQW5qbGZTVTJmeVNVMFdYVHN1d1ljCjU4QnlyK2l1TCtGQlZJY1VxRXF5Nkh5QzVsdHF0ZHl6ZGM2TEJ0Q0dJNzlHMVk0UFB3VDAxeHlTZnZhbFk4TDFYNDR1VDZFWUdRSXIKTWdxQ1pIMFdrOUdqUWpCQU1CMEdBMVVkRGdRV0JCUjhYUUtFRTlUTWlwdUJ6aGNjTGlrZW5FaGpRakFPQmdOVkhROEJBZjhFQkFNQwpBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFLQmdncWhrak9QUVFEQXdOcEFEQm1BakVBdnZOaHp3SVFIV1NWQjdnWWJvaUZCUytECkNCZVF5aCtLVE9nTkczcXhyZFdCQ1Vmdk82d0lCSHhjbWJIdFJ3ZlNBakVBbmJwVi9LbEs2TzN0NW5ZQlFudkkrR0RaalZHTFZUdjcKakh2clpRbkQrSmJOUjZpQzhoWlZkeVIrRWhDVkJDeWoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign Root CA - C1 (O=eMudhra Inc)\n# SHA-256 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F\n[settings.pki.emsign-root-c1]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURjekNDQWx1Z0F3SUJBZ0lMQUs3UEFMckV6ekw0UTdJd0RRWUpLb1pJaHZjTkFRRUxCUUF3VmpFTE1Ba0dBMVVFQmhNQ1ZWTXgKRXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUURFeE5sYlZOcApaMjRnVW05dmRDQkRRU0F0SUVNeE1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93VmpFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUUQKRXhObGJWTnBaMjRnVW05dmRDQkRRU0F0SUVNeE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeit1cAp1ZkdaQmN6WUtDRks4M00wVVlSV0VQV2dUeXdTNC9vVG1pZlF6L2w1R25SZkhYazUvRnY0Y0k3Z2tsTDM1Q1g1VklQWkhkUElXb1UvClhzZTJCKzQrd002YXI2eFdRaW81SlhEV3Y3VjdOcTJzOW5QY3pkY2Rpb09sK3l1UUZUZHJIQ1pIM0RzcFZwTnFzOEZxT3AwOTljR1gKT0ZnRml4d1I0K1MwdUYyRkhZUCtlRjhMUldnWVNLVkdjelE3L2cvSWRydkhHUE1GMFliemhlM251ZGt5clZXSXpxYTJrYkJQckg0VgpJNWIyUC9BZ05CYmVDc2JFQkVWNWY2Zjl2dEtwcGErY3hTTXE5endoYkwydmowN0ZPckx6TkJMODM0QWFTYVRVcVpYM25vbGVvb21zCmxNdW9hSnV2aW1VbnpZbnUzWXkxYXlsd1E2QnBDK1M1RHdJREFRQUJvMEl3UURBZEJnTlZIUTRFRmdRVS9xSGdjQjRxQXpsU1drSysKWEpHRmVoaXFUYlV3RGdZRFZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQU1KS1Z2b1ZJWHNvb3VubEhmdjRMY1E1bGtGTU95Y3N4R3dZRllER3JLOUhXUzhtQytNMnNPODcva09YU1RLWkVoVmIzeEVwCi82dFQrTHZCZUErc25GT3ZWNzFvakQxcE0vQ2pvQ05qTzJSbklrU3QxWEhMVmlwNGtxTlBFakUyTnVMZS9nREVvMkFQSjYyZ3NJcTEKTm5wU29iMG45Q0FuWXVoTmxDUVQ1QW9FNlR5ckxzaERDVXJHWVFUbFNUUiswOFRJOVEvQXF1bTZWRjd6WXl0UFQxRFUvcmw3bVl3OQp3QzY4QWl2VHhFRGtpZ2N4SHB2T0pwa1QreEhxbWlJTUVSbkhYaHVCVURESWxoSnU1OHRCZjVFN29rZTNWSUFiM0FETW1wRHF3OE5RCkJtSU1NTUFWU0tlb1dYemhyaUtpNGdwNkQvcGlxMUpNNGZIZnlyNkREVUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\"\nEOF\n```\n\nReferences:\n\n- CVE-2026-111943\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-24T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}