Stream: git-wasmtime

Topic: wasmtime / issue #14893 RUSTSEC-2026-0383: Bundled root c...

Wasmtime GitHub notifications bot (Oct 21 2026 at 00:13):

github-actions[bot] opened issue #14893:

Bundled root certificates allow trust in distrusted emSign intermediates

Details
Package	webpki-root-certs
Version	1.0.4
URL	https://github.com/rustls/webpki-roots/pull/133
Date	2026-10-19
Patched versions	>=1.0.10

Affected versions include emSign ECC Root CA - G3, which can allow certificate
paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.

Version 1.0.10+ removes this root.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 21 2026 at 17:01):

pchickey closed issue #14893:

Bundled root certificates allow trust in distrusted emSign intermediates

Details
Package	webpki-root-certs
Version	1.0.4
URL	https://github.com/rustls/webpki-roots/pull/133
Date	2026-10-19
Patched versions	>=1.0.10

Affected versions include emSign ECC Root CA - G3, which can allow certificate
paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.

Version 1.0.10+ removes this root.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC