r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

801 Upvotes

95% Upvoted

213 comments sorted by

View all comments

Show parent comments

4

u/_shulhan 1d ago

Libraries depends on OS, so one needs to wait for their distro to push new updates.

Containers also depend on whatever OS it is build and it's requires double steps, waiting for base OS level updates, rebuilding new images.

2

u/ace_gravity 1d ago

Unless you're using python or go or Node or rust which have popular libraries that use their own CA store. 

2

u/_shulhan 1d ago

I am not sure what the "popular libraries" means. Did you mean any unofficial libraries? Or official library from the language itself?

In Go, they patch the compiler by rejecting the offending certificates during handshake, not by updating some files: https://go-review.googlesource.com/c/go/+/851165

And AFAIK, Go also does not store their own CA but read it from OS files or from syscall:

https://go.googlesource.com/go/+/refs/heads/master/src/crypto/x509/

1

u/ace_gravity 1d ago

Node has its own cert store and doesn't use system ca by default. Python has certifi package that is used by the popular requests library. (This is why the azure cli doesn't use the system ca by default) Rust has the popular webpki-roots package. I'm less familiar with Go, was extrapolating based on the issue

1

u/ghjm 20h ago

We're about to discover what a pain in the ass the language repo model for CA distribution is. For the distro you can just do an apt upgrade or dnf update and everything's fixed. For certifi (and similar) you have to track down every container and every venv and update all of them individually.

There will be old Python apps that still trust the compromised CAs for years. It's functionally almost impossible to find all of them.

1

u/yrro 18h ago

It's certainly part of the ecosystem that I wish was done by a single system daemon, accessible by unix socket. Offload all trust decisions etc. to the daemon, which has a single consistent set of trust roots, can handle OCSP, CRL fetching, etc...

1

u/SoilMassive6850 15h ago

People packaging python software into system packages keep winning. Ubuntus python3-certifi is just a stub pointing at system certs.