Apple today released macOS updates that address a security gap involving compromised eMudhra certificates, after initially blocking them in Safari, Mail, and other apps in October. Here are the details.
A few weeks ago, Mozilla reported that private keys of eight intermediate certificate authorities operated by eMudhra, an Indian digital certification company, had been compromised.
In essence, these certificates are used to establish trust in digital certificates that verify website identities and enable secure connections.
With access to the compromised private keys, bad actors could potentially create fraudulent certificates that appear legitimate, allowing them to impersonate websites and intercept sensitive user information.
In response to the compromise, Apple began automatically blocking the affected certificates on October 19, followed by additional protections on October 23.
These changes were delivered through automatic certificate configuration updates, meaning users didn’t need to install a macOS update to be protected.
While these measures protected Safari, Mail, and apps that use Apple’s networking and security frameworks, they didn’t cover all of macOS, as certain command-line tools, including curl and git, could still accept the compromised certificates.
At the time, Apple published a support article with instructions for administrators to manually address this remaining security gap, while promising a fix in a future macOS update.
Today, Apple updated the document to confirm that the fix is now available.
3, released earlier today , prevent the affected command-line tools from accepting the compromised certificates, eliminating the need for administrators to manually address the issue.
Source link
