Multiple technology companies have moved to block eight vulnerable intermediate certificates issued by Indian digital certificate authority eMudhra Limited after flaws were found in the private key generation process. According to the incident details, the weakness could let attackers forge certificates, impersonate legitimate websites, and intercept, read, or alter user communications. Mozilla cryptography engineer Dennis Jackson said in an incident report that Mozilla received the vulnerability report on Oct. 17 and independently recovered the affected private keys, confirming that the generation mechanism had a serious flaw and was easy to exploit. Mozilla then blocked the certificates in Firefox through OneCRL and released browser updates for desktop and Android on Oct. 20. Mozilla also disclosed that Chrome blocked the certificates on Saturday, Apple devices completed the block on Monday, and Microsoft platforms took corresponding action on Tuesday. Cloudflare updated protections for Cloudflare One, the WARP client, and Cloudflare Tunnel on Tuesday as well.
Multiple technology companies have urgently blocked eight vulnerable intermediate certificates issued by Indian digital certificate authority eMudhra Limited.
The affected certificates were found to have flaws in the private key generation process. That weakness could allow attackers to forge certificates, impersonate legitimate websites, and intercept, read, or alter user communications.
Mozilla says the key generation mechanism had a serious flaw
Mozilla cryptography engineer Dennis Jackson said in an incident report that Mozilla received the vulnerability report on Oct. 17 and independently recovered the related private keys, confirming that the generation mechanism had a serious flaw and was easy to exploit.
Mozilla then blocked the affected certificates in Firefox through OneCRL and released browser updates for desktop and Android on Oct. 20.
Chrome, Apple, Microsoft and Cloudflare also responded
According to Mozilla, Chrome blocked the certificates on Saturday, Apple devices completed the block on Monday, and Microsoft platforms took corresponding action on Tuesday.
Cloudflare also updated protections on Tuesday for Cloudflare One, the WARP client, and Cloudflare Tunnel.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
