Red Hat Security Advisory: ca-certificates security update

The Red Hat ca-certificates package, which includes a set of CA certificates selected by the Mozilla Foundation for PKI use, has been updated to distrust eMudhra intermediate CA certificates due to security concerns detailed in CVE-2026-114406. This update affects Red Hat Enterprise Linux 9.6 Extended Update Support and related variants across multiple architectures. The advisory indicates a critical security impact and provides updated packages to remediate the issue by removing trust from the problematic intermediate CA certificates.

Trusting compromised or insecure intermediate CA certificates can allow attackers to issue fraudulent certificates, potentially enabling man-in-the-middle attacks or impersonation of trusted entities. By distrusting the eMudhra intermediate CA certificates, this update mitigates the risk of such misuse. Systems not updated remain vulnerable to accepting certificates issued by these distrusted intermediates, which could undermine secure communications.

A security update for the ca-certificates package is available from Red Hat for Enterprise Linux 9.6 and related variants. Applying this update will distrust the eMudhra intermediate CA certificates and mitigate the security concern. Users should follow Red Hat's official guidance at https://access.redhat.com/articles/11258 to apply the update promptly. No additional mitigation is required beyond applying the official update.