HN

Need help?
<- Back
Ten days later, Git on macOS still trusts the compromised eMudhra certificates

Ten days later, Git on macOS still trusts the compromised eMudhra certificates

galadran

Comments (203)

  • chrisweekly
    Right, so it's not just git, it's a bunch of system-provided utilities; macOS trusts bad certs, and these utils that trust the OS are affected. I use homebrew for my git and curl but haven't yet checked to confirm whether that matters here. Kind of outrageous that Apple's guidance is to edit the cert chain manually, and to expect that subsequent OS updates may revert your mitigation, reintroducing the vulnerability (as happened at least once so far).
  • jrochkind1
    That MacOS hasn't removed from OS-level /etc/ssl seems like a big deal, affecting more than just OS-supplied git. Is /etc/certs not used by most graphical Mac software, I guess? The chaotic state of OS-level cert management, on Linux as well, is pretty dismaying.If Apple is still trying to brand themselves as security-forward, you'd think removing the revoked CA certs from /etc in a system update would be a pretty easy thing to do?
  • truelson
    Here's what apple (themselves) recommends to patch: https://support.apple.com/en-us/149555Pretty much every developer on mac should probably run their patch.
  • devy
    Like many suggested, a proper fix might be harder than simply revoking a bunch of certificate like the blog authored assumed without breaking downstream features and functions in a large ecosystem and security conscious platform like macOS/iOS.However, there is certainly a chance that Apple team didn't think the impact was that bad given all the other protections in place.When Steve Jobs was alive, his Apple company email was leaked and published and Apple customers emailed him for features and fixes all the time and he personally responded once a while. Tim Cook did the same a couple times too. Perhaps the blog author should write in to the new CEO John Ternus or SVP of Software Engineering Craig Federighi too to see if they can fix that.https://www.apple.com/leadership/
  • qaz_plm
  • kryptiskt
    I'm not being sarcastic when I say that Apple should copy Windows Update, I have no idea how they have got this far without a method to add small patches outside monolithic OS updates.
  • gringofyx
    A flat cert.pem file (or similar) can't say "distrust this intermediate".macOS already has the verifier needed (Security.framework/trustd path that protected Safari). It would be good if MacOS routed CLIs through it.
  • paxy
    This should have been a macOS security update on day 0. Dragging their feet over it is sadly typical when it comes to Apple software nowadays.
  • commandlinefan
    It seems like we've all just... given up on certificate revocation? CRLs and OCSP were designed for exactly this sort of thing, but they both seen to have been abandoned as unworkable with no replacement.
  • paaloeye
    > Anyone can intercept any HTTPS connection these tools make.yeah, it's not ideal but the scale of the threat is way overblown tbh. You have to compromise a lot to be able to make a MITM here.Let's not treat it like PHP2Shell.
  • faxmeyourcode
    While there is no proof that anyone knew about these weak keys for the year and a half that they were trusted by virtually everybody, and there's no evidence of MITM attacks happening in the wild because of it, you can imagine the payoff that a three letter agency would have if, for even 10 days, there was an opportunity to harvest credentials from important people in high places.I have no evidence or proof, but I am convinced this wrap/unwrap key generation debacle was intentional and the weak keys were discovered and kept secret by the agencies or governments and used to exploit their adversaries.You don't need to perform a traditional MITM attack _if you own the airport_ or you _own the free public wifi_. The traffic can be harvested in clear text and we have to come to terms with the _remote possibility_ that this was going on for over a year and a half. If not that long, then certainly for the past 10 days.
  • amelius
    Don't run important stuff on your consumer devices. Apple is a consumer brand.
  • kd913
    They just released MacOS 27.2 a few days ago? How and why did they not do a patch at least then?
  • 6thbit
    There must be a long list of things that aren’t fully patched for this yet, on laptops, on servers. Think of packages that ship their own trust anchors, isn’t there a rust crate that compiles with some root certs embedded?On one hand there’s unmaintained packages that won’t update dependencies. On the other hand, fixed dependencies did not necessarily backport to all possible versions in the wild, making update as a fix unviable for those.
  • thefilmore
    Apple can fix this by building curl with SecTrust [1].[1] https://eissing.org/icing/posts/curl-apple-sectrust/
  • thought_alarm
    Delete /etc/ssl/cert.pem and replace it with the one from MacPorts. # /usr/bin/curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/ Your client successfully connected to the site. That's bad! # sudo mv /etc/ssl/cert.pem /tmp/ # sudo ln -s /opt/local/libexec/openssl3/etc/openssl/cert.pem /etc/ssl/cert.pem # /usr/bin/curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/ curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html
  • altcognito
    I'm not that familiar with the MacOSx system, but do they have a "minor" update path that I'm not aware of? It seems that everything is an 8gb update. Is that why this update isn't getting put out?
  • kqp
    Can we get a title edit? OP’s title implies this is a Git bug, but the bug applies to half of macOS, including curl, openssl, python, perl, and ruby, and to only the macOS version of Git. The original title is less misleading, but personally I’d have titled it something like “macOS still trusts the compromised eMudhra certificates in git, curl, openssl, python3, perl, ruby, more”.
  • bluechair
    To get mine to finally update, I had to leave my laptop plugged in for a couple of hours. There’s some trustd process that runs every so often; I couldn’t figure out a way to manually trigger the sync.
  • davidcollantes
    Running (uname -a) Darwin arrakis.local 27.2.0 Darwin Kernel Version 27.2.0: Wed Oct 14 23:47:07 PDT 2026; root:xnu-13432.41.4~25/RELEASE_ARM64_T8132 arm64, I get the following for both: curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above.
  • zoobab
    The only thing that works is fines.
  • cromka
    Things like this is why I moved back to Linux after 10 years on macOS.
  • biglyburrito
  • __MatrixMan__
    If you're not already in the habit of contacting your git remotes over ssh, its probably one worth building. This is gonna keep happening.
  • anon
    undefined
  • paaloeye
    Albeit helpful, the site is kinda cringe. It leaves a bad taste in my mouth knowing that the author is affiliated with Mozilla.Of course they would throw shades at Apple. That being said the situation isn't ideal and I'm sure Apple would have shipped an update if it were easy and warranted.
  • anon
    undefined
  • anon
    undefined
  • bcvvvy
    I have been wondering recently if Apple are bothering to maintain the Unix side of the OS. Seems like they occasionally remove or deprecate stuff but don’t put any serious effort into maintenance.This is just another one of those smells.
  • ltbarcly3
    Microsoft had a small golden age with Azure and Windows 10, and now they are going right back into a Vista-era-like rot. Github is down an awful lot. The reliability is worse than the product I work on for work by like 2 orders of magnitude and we have no ops team. It's a joke.Windows 11 is awful, lots of the fixes and modernization started in windows 10 has totally stalled, leaving users with 5 different places to change a setting instead of the one old place or one new place. Look how many different UI's there are to adjust sound card / sound settings or display settings. It's a complete mess. Their attempts to jump into the AI game have been a complete joke, despite already having integrated Cortana years ago. Putting Cortana on an llm is such an obvious thing to do, and they already did so much work to make that fully integrated into windows and force it on everyone even though it was trash, and now it's still trash and they don't seem to be able to adapt at all.Now they can't respond to a complete insecurity in one of their major products in weeks? Why do they even validate certs? Why doesn't revocation work in their app? I don't think they can really be trusted at this point.
  • franktankbank
    What would cause this delay from apple? Is there something behind the scenes that can explain it?
  • WesolyKubeczek
    Doesn’t macOS have a way to generate cert.pem from the keychain?
  • commandersaki
    Not really a big deal, the window to do an MITM has passed.
  • aaomidi
    This file is used by a bunch of CLIs. Apple is fundamentally dropping the ball here from a security perspective.
  • jon128
    I would expect nothing less from eMudhra and nothing less from macOS.
  • InsidiousWombat
    That's disingenuous titleIt should be "Apple still ships compromised CA in /etc/". Git is just a victim like every other app using system CA
  • arbor-group
    [flagged]
  • 40PT
    [flagged]
  • rbaRBA
    [flagged]