Peaked at #2 Now #3
eMudhra intermediate certificates use weak keys
Warns millions of IoT devices and containers will be hacked via legitimately signed malware after the eMudhra breach.
Key points
- Cloudflare said it is deploying mitigations and releasing client updates after eight eMudhra intermediate certificates were found to use weak keys.
- @ghidraninja said the private key for the revoked eMudhra intermediate was apparently 4, and asked how the root is still trusted.
- @charliermarsh said uv 0.13.4 updates bundled certs in response to the eMudra incident, and that it affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc.
- The original poster added that the keys were not just 4, but 4, 56, 66, 115, 155, 156, 230, 237.
Key points and the reaction summary are written by AI from the posts on this page. Check the original post. How we use AI
Original post
What others are saying
2 more-
Cloudflare @Cloudflare 1,097
Cloudflare says after eight eMudhra intermediate certs were found using weak keys, it is deploying mitigations and client updates, explaining impact and next steps.
View on X -
Cloudflare found eight eMudhra intermediate certificates using weak keys, deploying mitigations and releasing client updates.
View on X
Top replies on X
Reaction on X: Replies were mostly shock and dark humor, with several users joking about weak PINs; the original poster added the full list of weak keys.
Sign in to see 5 top replies from X
From @ghidraninja, @amoswap, @lucasteske and others. Spam removed, with English and Chinese translations.
Discussion 0
Sign up Sign in to join the discussion
No comments yet. Start the conversation.