Teku 26.10.3 and Besu 26.10.2 stop trusting eMudhra certificates after eight eMudhra intermediate keys found weak
Event summary
CoinDesk reported that Teku released version 26.10.3 and Besu released version 26.10.2. Both updates stop trusting certificates tied to eMudhra in their Docker images. Researchers reported on Oct. 17 that eight of eMudhra’s intermediate certificate private keys were generated with insufficient randomness.
CHRONOS Wire · October 29 · Alert 14
Publication details
- Published
- Updated
- Revision
- r1
- Source
- CoinDesk
Cliff Notes
- Teku 26.10.3 and Besu 26.10.2 publish Docker images that stop trusting eMudhra after researchers found eight weak intermediate keys on Oct. 17.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
Researchers found eight weak intermediate certificate keys from Indian CA eMudhra. Two Ethereum client projects, Teku and Besu, released updates that stop trusting those eMudhra certificates in their Docker images, reducing the risk of forged TLS connections for deployments that use the updated images.
Why Urgent Level 3
Deployments that do not adopt the updated images may continue to trust eMudhra-signed certificates until their trust stores are changed, leaving potential for forged TLS connections in affected configurations.
What Changed
Teku published version 26.10.3 and Besu published version 26.10.2. Both client updates ship Docker images that no longer trust certificates tied to eMudhra after researchers reported eight intermediate keys had been generated with insufficient randomness.
What Is Genuinely New
Teku 26.10.3 and Besu 26.10.2 include Docker images that stop trusting eMudhra-linked certificates, following a report that eight eMudhra intermediate keys were weak.
CHRONOS Bottom Line
Operators running Teku or Besu from the published Docker images should update to the released versions to remove trust in eMudhra certificates; deployments that rely on system or separately managed trust stores must be checked and updated if they still trust eMudhra.
Uncertainties / Known Unknowns
No exploitation has been reported in the cited reporting. The scope of other services or appliances that relied on eMudhra-signed certificates is not detailed in the available excerpts.
Detailed Analysis
The reporting documents two client releases and notes the Docker images they ship no longer trust eMudhra certificates. The underlying research finding of weak keys is dated Oct. 17. The remediation in Docker images protects containerised deployments that pull the updated images; other deployment models must be inspected for residual trust in eMudhra certificates.
Sources / Evidence
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.