Eight intermediate certificate authority keys from Indian certification provider eMudhra have been compromised, according to announcements from Mozilla and Google’s Chrome Root Program on October 20. A researcher discovered the breach on October 17 and reported it to the root programs. The compromised keys could allow someone to issue fraudulent certificates for any website that browsers would accept. Chrome and Firefox blocked the affected certificates within hours of verification, and no unauthorized certificates using these keys had been logged to Certificate Transparency before the blocks were implemented.
Multiple software platforms have released emergency updates to address the vulnerability. Go released security updates blocking any certificate chain containing the compromised keys, Firefox pushed revocation lists to users, and programming libraries like Python’s certifi and Rust’s webpki-roots removed the affected root certificates from their bundles. Mozilla removed the compromised root from its NSS library, and Chrome plans to remove it from its root store in version 43. The circumstances surrounding how the keys were compromised and when the breach occurred remain under investigation by Mozilla, root programs, and other certificate authorities.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
