search
EMudhra
Trends
- 1Apple's git still trusts compromised eMudhra certificates●Apple's git still trusts the compromised eMudhra certificates
Apple's code repositories are still accepting TLS certificates issued by Indian certificate authority eMudhra, whose intermediate certificates were compromised in a reported security incident. The report argues that despite the compromise being disclosed, certificate validation on Apple's git infrastructure has not been updated to reject the affected certificates. Developers are discussing the potential exposure of Apple's source code infrastructure to interception.
- 2Chrome Root Store to change eMudhra CA certificates▼Upcoming change for eMudhra CA certificates included in the Chrome Root Store
Google has announced an upcoming change to how eMudhra certificate authority certificates are treated in the Chrome Root Store, the list of CAs whose certificates Chrome trusts by default. The notice was posted through the CA/Browser Forum's public discussion list. Details of the specific change were not included in the available information.
- 3macOS 27.3 Beta Pulls Compromised eMudhra Certificates▼macOS 27.3 Includes an Important Security Fix The first macOS 27.3 developer beta includes an important security fix tha
Apple's first macOS 27.3 developer beta includes a security fix that stops command-line tools from accepting web certificates issued by eMudhra, a certificate authority whose credentials were compromised. The update removes the affected certificates from the system's trust store. Observers are highlighting the fix as an important step for Mac users' security.
- 4Apple blocks compromised eMudhra certificates, but macOS tools lag behind▼Apple says its frameworks already block compromised eMudhra TLS certificates, but some macOS command-line tools, includi
Apple says its frameworks already reject compromised eMudhra TLS certificates, but some macOS command-line tools, including curl and git, can still accept them via /etc/ssl/cert.pem. The macOS 27.3 beta reportedly closes the gap, while a public fix is still pending. Security admins are being urged to take interim precautions.