CONNECT WITH US
Cyber Security

Cyber Security

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

The Hacker News logo

Published on

Add as a preferred source on Google
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys.

Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not named, and that it is blocking them because of "specific security concerns around their operation."

It handled the fix on its URGENT track, the one reserved for its most serious issues, and recommends upgrading immediately.

Two days earlier, on October 17, Mozilla added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to OneCRL, the list Firefox uses to block certificates. The Mozilla bug behind those entries is closed to the public, and neither Mozilla nor Go has said what prompted its action. Whether Chrome, Apple, or Microsoft have taken similar action is not established.

Go's change lists only the SHA-256 hashes of the eight keys. A commenter on the Go issue matched all eight to eMudhra intermediates by looking the hashes up in certificate records.

By that matching, six are TLS intermediates issued under the same emSign Root TLS CA - G3 that Mozilla's entries name, and two are code-signing intermediates under emSign Root CS CA - G3:

The Hacker News has not independently checked the hashes against the certificates. Mozilla's six entries carry the same issuing root, but Mozilla's records do not name the six certificates.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.