https://seclists.org/oss-sec/2026/q4/332: Comodo AAA Services Root and S/MIME
Affected Software
Frequently Asked Questions
Is there evidence that a specific mail client is affected?
The material identifies Mozilla Thunderbird's certificate store as a potential trust anchor to investigate, but it does not establish that Thunderbird or any other specific application is affected.
What implementation behavior is relevant when assessing exposure?
The key question is whether an email application accepts a web/TLS intermediate certificate to sign an S/MIME certificate. Implementations that do not explicitly check X.509 purposes for S/MIME signing or encryption may rely on their cryptographic library's certificate-purpose validation.
How should teams assess an application when no patch or confirmed affected version is provided?
Determine whether the application uses the NSS or Thunderbird certificate store for S/MIME trust and test whether its X.509 path validation enforces S/MIME signing and encryption purposes. The provided material does not identify a patch, workaround, affected version, or known exploitation.