Update bundled root certificates for 6.9

[desrosj]

This ticket is for updating the Root Certificates bundle included in WordPress Core for the 6.9 release cycle.

Previously:

• #62811 (6.8)
• #54207 (5.8.2)
• #50828 (5.5)
• #34935 (4.4.1)
• #30434 (4.4)

Note: Some unexpired legacy 1024-bit certificates are included manually for backwards compatibility. See [35919].

[desrosj]

In 60320:

Security: Update composer/ca-bundle to version 1.5.7.

See #63165.

[audrasjb]

@desrosj should we backport this to branch 6.8? Worth considering fixing this in 6.8.2 as it is not something that should break anything.

[desrosj]

Replying to audrasjb:

@desrosj should we backport this to branch 6.8?

I think that's reasonable, yes.

Ideally, we should keep these certificates files in sync for all branches currently eligible to receive security updates. But it doesn't make sense to backport every update. After the changes applied in #62811, the patches should be trivial to backport without any conflicts.

We need to just decide what frequency we're comfortable with. Syncing every time there's an update (though it is infrequent) is probably not worth the extra noise. It could also just be a checklist item for the Security Team when they decide to push a patch to older branches.

[desrosj]

In 60369:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.8 branch.

See #63165.

[desrosj]

In 60370:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.7 branch.

See #63165.

[desrosj]

In 60371:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.6 branch.

See #63165.

[desrosj]

In 60372:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.5 branch.

See #63165.

[desrosj]

In 60373:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.4 branch.

See #63165.

[desrosj]

In 60374:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.3 branch.

See #63165.

[desrosj]

In 60375:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.2 branch.

See #63165.

[desrosj]

In 60376:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.1 branch.

See #63165.

[desrosj]

In 60377:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 6.0 branch.

See #63165.

[desrosj]

In 60378:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.9 branch.

See #63165.

[desrosj]

In 60379:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.8 branch.

See #63165.

[desrosj]

In 60380:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.7 branch.

See #63165.

[desrosj]

In 60382:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.5 branch.

See #63165.

[desrosj]

In 60383:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.4 branch.

See #63165.

[desrosj]

In 60384:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.3 branch.

See #63165.

[desrosj]

In 60385:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.2 branch.

See #63165.

[desrosj]

In 60386:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.1 branch.

See #63165.

[desrosj]

In 60387:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 5.0 branch.

See #63165.

[desrosj]

In 60388:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.9 branch.

See #63165.

[desrosj]

In 60389:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.8 branch.

See #63165.

[desrosj]

In 60390:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.7 branch.

See #63165.

[desrosj]

In 60391:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.6 branch.

See #63165.

[desrosj]

In 60392:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.5 branch.

See #63165.

[desrosj]

In 60393:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.4 branch.

See #63165.

[desrosj]

In 60394:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.3 branch.

See #63165.

[desrosj]

In 60396:

Security: Update composer/ca-bundle to version 1.5.7.

Merges [60320] to the 4.1 branch.

See #63165.

Version bump and changelog update for WordPress 4.7.30

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 4.8.26

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 4.9.27

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.0.23

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.1.20

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.2.22

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.3.19

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.4.17

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.5.16

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.6.15

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.7.13

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.8.11

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 5.9.11

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.0.10

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.1.8

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.2.7

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.3.6

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.4.6

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.5.7

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.6.4

There are no planned security fixes for this release other than updating the bundled root certificates.

Version bump and changelog update for WordPress 6.7.3

There are no planned security fixes for this release other than updating the bundled root certificates.

Thanks for fixing this John. You are correct. I can't do so via the UI but consider your contribution approved.

Thanks for fixing this John. You are correct. I can't do so via the UI but consider your contribution approved.

Thanks for fixing this John. You are correct. I can't do so via the UI but consider your contribution approved.

Thanks for fixing this John. You are correct. I can't do so via the UI but consider your contribution approved.

https://core.trac.wordpress.org/changeset/60541

https://core.trac.wordpress.org/changeset/60542

https://core.trac.wordpress.org/changeset/60543

https://core.trac.wordpress.org/changeset/60544

https://core.trac.wordpress.org/changeset/60545

https://core.trac.wordpress.org/changeset/60546

https://core.trac.wordpress.org/changeset/60547

https://core.trac.wordpress.org/changeset/60548

https://core.trac.wordpress.org/changeset/60549

https://core.trac.wordpress.org/changeset/60550

https://core.trac.wordpress.org/changeset/60551

https://core.trac.wordpress.org/changeset/60552

https://core.trac.wordpress.org/changeset/60553

https://core.trac.wordpress.org/changeset/60554

https://core.trac.wordpress.org/changeset/60555

https://core.trac.wordpress.org/changeset/60556

https://core.trac.wordpress.org/changeset/60557

https://core.trac.wordpress.org/changeset/60558

https://core.trac.wordpress.org/changeset/60559

https://core.trac.wordpress.org/changeset/60560

https://core.trac.wordpress.org/changeset/60561

[desrosj]

In 60691:

Security: Update composer/ca-bundle to version 1.5.8.

See #63165.

[jorbin]

Noting that composer/ca-bundle has now been updated to version 1.5.9. ​https://github.com/composer/ca-bundle/releases/tag/1.5.9

[jorbin]

In 61146:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

See #63165.

[desrosj]

In 61147:

Security: Update composer/ca-bundle to version 1.5.8.

Merges [60691] to the 6.8 branch.
See #63165.

[desrosj]

In 61148:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [61146] to the 6.8 branch.
See #63165.

[desrosj]

In 61149:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.7 branch.
See #63165.

[desrosj]

In 61150:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.6 branch.
See #63165.

[desrosj]

In 61151:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.5 branch.
See #63165.

[desrosj]

In 61152:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.4 branch.
See #63165.

[desrosj]

In 61153:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.3 branch.
See #63165.

[desrosj]

In 61154:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.2 branch.
See #63165.

[desrosj]

In 61155:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.1 branch.
See #63165.

[desrosj]

In 61156:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 6.0 branch.
See #63165.

[desrosj]

In 61157:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.9 branch.
See #63165.

[desrosj]

In 61158:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.8 branch.
See #63165.

[desrosj]

In 61159:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.7 branch.
See #63165.

[desrosj]

In 61160:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.6 branch.
See #63165.

[desrosj]

In 61161:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.5 branch.
See #63165.

[desrosj]

In 61162:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.4 branch.
See #63165.

[desrosj]

In 61163:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.3 branch.
See #63165.

[desrosj]

In 61164:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.2 branch.
See #63165.

[desrosj]

In 61165:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.1 branch.
See #63165.

[desrosj]

In 61166:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 5.0 branch.
See #63165.

[desrosj]

In 61167:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 4.9 branch.
See #63165.

[desrosj]

In 61168:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 4.8 branch.
See #63165.

[desrosj]

In 61169:

Security: Update composer/ca-bundle to version 1.5.9.

Props jorbin, desrosj.

Merges [60691], [61146] to the 4.7 branch.
See #63165.

[desrosj]

Closing this as fixed. There was a release today of the package, so there should be no more prior tot he 6.9 release.

I've also gone and backported both the 1.5.8 and 1.5.9 updates all the way back to the 4.7 branch. These updates will be shipped if a security release is deemed necessary for each branch.

For future reference, backporting to WP <= 6.7 requires a bit of extra considerations for a few reasons:

• The composer.json file does not list the composer/ca-bundle dependency
• The src/wp-includes/certificates/cacert.pem file is not committed to version control.

Because of this, svn merge -c 60691,61146 '^/trunk' fails. This is what worked for me:

svn merge --accept working -c 60691,61146 '^/trunk' && svn revert composer.json.

The ca-bundle.crt files in each branch are identical, so we can assume there will only be conflicts in composer.json and cacert.pem. The --accept working uses the state of cacert.pem for the working copy, and then this just reverts the composer.json file manually.

[desrosj]

Opened #64245 for any updates required during the 7.0 cycle.