> It appears to me they do, and that is why everybody is saying to patch your python, go, and node infrastructure separately from /etc/ssl.
No it is not. As I said, the revoked key IDs is a supplementary list. It is not a root store. They do not add new root keys or transmit any public key material via this path. It may not contain data that is applicable to the root store being used, but it is perfectly permissible to relay a revocation 'out of band' as long as it represents a truly revoked certificate (CRLs and OCSP are out of band in the same sense)
Only in Java is the practice you're describing (full root store bundled with the runtime) widespread. (Edit: Node.js too, apparently)
I guess everybody is lying when they say to patch nodejs and python's certifi in response to this issue. They should listen to you instead about how it doesn't work that way, and stay vulnerable to MITM.
No it is not. As I said, the revoked key IDs is a supplementary list. It is not a root store. They do not add new root keys or transmit any public key material via this path. It may not contain data that is applicable to the root store being used, but it is perfectly permissible to relay a revocation 'out of band' as long as it represents a truly revoked certificate (CRLs and OCSP are out of band in the same sense)
Only in Java is the practice you're describing (full root store bundled with the runtime) widespread. (Edit: Node.js too, apparently)