Apple's command-line git, curl and python3 still trust the compromised eMudhra certificates, researchers warn
The page includes a one-line check (and a safe demo) to see if your Mac's git can be fooled; Apple's support note explains the manual fix.
Follow-up to last week's eMudhra breach, in which the private keys of eight of the Indian certificate authority's intermediate CAs were compromised. A community site run by Dennis Jackson says that as of October 28, the developer tools Apple ships with macOS, including git, curl and python3, still accept certificates from those CAs, 11 days after Apple was notified. It says macOS 27.2, released October 26, did not fix this and undid the manual workaround. Because anyone holding the keys can mint a certificate for any site, it argues that an attacker on the network path could intercept git clones and pushes or capture tokens; the page offers a test repository that impersonates GitHub.
Apple's support note says it has blocked the 12 affected certificates in Safari, Mail and apps using its networking frameworks since October 19, and the emSign ECC Root CA - G3 since October 23. It confirms that tools such as curl and git check /etc/ssl/cert.pem and can still accept these certificates until a future software update, and gives steps to remove the roots by hand.
On Hacker News, some argued the title should blame the shared certificate file rather than git, and one commenter said the threat is overblown because an attacker needs a network position first.
-
Man-in-the-middle attack
After exploring Apple's git still trusts the compromised eMudhra certificates, for the attack the warning is about, read Man-in-the-middle attack.
Defines the attack in which someone secretly relays, and can alter, the traffic between two parties who think they are talking directly.
Wikipedia · Wade · 5 min
0 -
Certificate authority
After exploring About the compromised eMudhra intermediate CAs - Apple Support, for why one CA's leaked keys matter to everyone, read Certificate authority.
Explains the trusted third parties that sign digital certificates vouching for who owns a public key, the system that a compromised CA undermines.
Wikipedia · Wade · 5 min
0