International
The Morning Dev

Only the news worth knowing

‹
 
B43/100

Breach · high

eMudhra intermediate CA private key compromise and revocation of its intermediate CAs

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Systems and users trusting certificates issued under eMudhra intermediate CAs

Tier B because: Full takeover OR secrets exposed OR supply chain

Reach

Attack

Damage

Fix

Secrets exposed

What to do

  1. Check whether your certificates chain to the revoked eMudhra intermediate CAs and plan replacement.

The Brief

  • eMudhra has revoked 8 more intermediate certificate authorities that it had previously declared unaffected by a key compromise.
  • The company's in-house Python script behind an October key compromise is the cause, even though it did not weaken these CAs' keys.
  • Each intermediate CA has its own private key used to sign certificates, so revocation affects certificates issued under them.

Why it matters

Revoked intermediate CAs invalidate certificates chained to them, so developers relying on eMudhra-issued certificates may face trust failures until replacements are in place.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsJudgment: eMudhra issues code-signing and TLS certificates that developers and IT teams rely on daily.
NoCore infrastructureJudgment: a single commercial CA vendor's intermediate CAs, not software nearly every team runs.
NoPopular toolJudgment: eMudhra is a regional CA provider, not a widely used developer framework, tool or package.
NoExploited in the wildThe Hacker News: reports an October key compromise and revocations, but no observed attacks using it.
NoPublic exploitThe Hacker News: no mention of published exploit code or proof-of-concept.
NoRemote, no loginThe Hacker News: does not describe how the keys were reached or any unauthenticated network access.
NoFull takeoverThe Hacker News: describes CA key compromise only, not code execution or admin takeover.
YesSecrets exposedThe Hacker News: reports compromise of CA private keys, which are secrets, leading to revocation of 8 CAs.
NoSupply chainThe Hacker News: no report of malicious code shipped through a trusted package, update or build channel.
NoNo fix yetThe Hacker News: reports revocations; no statement that a fix is unavailable or incomplete.

Timeline

  1. Key compromise linked to an in-house Python script at eMudhra (month reported as October; exact day not given in sources)

  2. foojay.io - Friends Of OpenJDK

    Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise

  3. Python Software Foundation News

    How the Python ecosystem responded to the eMudhra intermediate compromise

  4. eMudhra revokes 8 more intermediate CAs previously declared unaffected

  5. The Hacker News

    eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

  6. top scoring links : programming

    eMudhra's official incident report on how they ended up with private key 4

  7. BleepingComputer

    eMudhra revokes 8 more CA certificates after private key mishap

Full coverage · 5 sources

First seen · 5 sources · Full story page · How tiers are decided