r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

798 Upvotes

95% Upvoted

213 comments sorted by

View all comments

Show parent comments

38

u/moanos 1d ago

Correct, but that means recompiling every go binary for example. A lot of work to be done patching this one out.

12

u/wRAR_ 1d ago

shrug we told people that static compilation is bad for security

9

u/JockstrapCummies 1d ago

I miss the days when a single apt-get upgrade to ca-certificates and libssl etc. actually brought everything up to security.

Nowadays all these new software projects are their own static binary with vendored libs, installed through fucking curl and pipes, or some modern variation of container/Flatpaks/Snap with god knows what vendored and vulnerable library.

1

u/AtlanticPortal 18h ago

I am furious with the developer of a flatpaked app that doesn’t want to fix his shit by not using the OS CA store.