SUSE-SU-2025:20336-1 Security update for ca-certificates-mozilla
An attacker could bypass certificate trust restrictions because distrusted certificates were not correctly removed from the trust store.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is SUSE-SU-2025:20336-1?
SUSE-SU-2025:20336-1 is a vulnerability in ca-certificates-mozilla, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for ca-certificates-mozilla fixes the following issues:
test for a concretely missing certificate rather than just the directory, as the latter is now also provided by openssl-3
Re-create java-cacerts with SOURCE_DATE_EPOCH set for reproducible builds (bsc#1229003)
explicit remove distrusted certs, as the distrust does not get exported correctly and the SSL certs are still trusted. (bsc#1240343)
- Entrust.net Premium 2048 Secure Server CA
- Entrust Root Certification Authority
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- GlobalSign Root E46
- GLOBALTRUST 2020
pass file argument to awk (bsc#1240009)
update to 2.74 state of Mozilla SSL root CAs: Removed:
- SwissSign Silver CA - G2 Added:
- D-TRUST BR Root CA 2 2023
- D-TRUST EV Root CA 2 2023
remove extensive signature printing in comments of the cert bundle
Define two macros to break a build cycle with p11-kit.
Updated to 2.72 state of Mozilla SSL root CAs (bsc#1234798) Removed:
- SecureSign RootCA11
- Security Communication RootCA3 Added:
- TWCA CYBER Root CA
- TWCA Global Root CA G2
- SecureSign Root CA12
- SecureSign Root CA14
- SecureSign Root CA15
Which versions are affected by SUSE-SU-2025:20336-1?
Linux distribution packages (1)
ca-certificates-mozilla SUSE:Linux Micro 6.0 | All versions | 2.74-1.1 |
How do I fix SUSE-SU-2025:20336-1?
Apply the vendor's patch.
Is SUSE-SU-2025:20336-1 being exploited?
There is no known exploitation of SUSE-SU-2025:20336-1 in the wild and no public exploit code.