Apple fixes eMudhra certificate gap in macOS command-line tools | Magica
Apple extends eMudhra certificate block to macOS command-line tools
Editorial Team
••📖6 min read
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Apple says macOS 27.2.1, 26.7.3 and 15.8.3 block compromised eMudhra certificates in affected bundled command-line tools.
Earlier automatic protections covered Safari, Mail and apps using Apple’s frameworks, leaving a separate certificate-file path exposed.
Removing root certificates can disrupt verification of some websites; apps with independent trust lists need developer guidance.
Apple says its November 9 macOS updates close a certificate-trust gap that allowed command-line tools such as curl and git to accept compromised certificates from Indian certificate authority eMudhra after Safari and Mail had already been protected. The Mac operating-system maker says in its updated advisory that macOS 27.2.1, 26.7.3 and 15.8.3 extend the block to affected tools included with macOS or its Xcode Command Line Tools developer package.
The distinction matters because protection depended on which software handled a connection. An automatic block delivered to Apple’s networking and security frameworks did not secure every tool on the same Mac. The updates replace a manual workaround for the affected bundled tools, while leaving administrators responsible for checking software that maintains its own certificate list.
Apple’s automatic framework protections preceded the macOS updates protecting affected bundled command-line tools. Graphic: Magica. Source: NHS England Digital.
Why the browser block left a gap
eMudhra operated eight intermediate certification authorities whose private keys were compromised. Intermediate authorities sit between trusted root authorities and the certificates used to authenticate websites or software. Apple says six of the affected authorities could issue TLS certificates for website authentication; two were for code signing and were not trusted by Apple’s frameworks. Possession of the six TLS authorities’ keys could let an attacker create certificates appearing valid for any website.
The problem was weak key generation, rather than a demonstrated theft of keys from the company’s systems. An October 23 NHS England cyber alert described insufficient randomness that made the private keys recoverable. It relayed eMudhra’s statements that the affected intermediates had issued no certificates, there was no evidence of infrastructure compromise and no data breach had been reported. Those statements do not eliminate the risk of fraudulent certificates created by someone else.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
Apple began automatically blocking the affected certificates on October 19 and added protections on October 23, according to a report tracing the rollout. These certificate-configuration changes did not require users to install a macOS update.
But Apple says some bundled tools—including curl, git, python3, ruby, perl and openssl—check certificates against /etc/ssl/cert.pem. For chains ending at a root certificate in that file, those tools did not consult Apple’s block or check whether a certificate had been revoked. The NHS alert dates eMudhra’s revocation to October 18; Apple says fellow certificate authority Sectigo also revoked the affected certificates. Revocation alone therefore did not close the command-line tools’ trust path.
Mozilla, which maintains the Firefox browser, had already taken a similar two-part approach. In its October 20 account, Mozilla said it distributed a block through OneCRL, its centralized revocation list, to all Firefox users with standard configurations in less than three hours after receiving the October 17 report. That required neither a browser update nor a restart.
Coverage still depended on configuration and software. Mozilla released browser updates for users whose custom settings could prevent receipt of OneCRL changes, and an October 21 Android update addressed some clients failing to apply the bundled blocklist immediately after startup. It also announced an update to the NSS trusted certificate list for other applications using its trust store without OneCRL. Mozilla warned that an attacker able to intercept a connection could use fraudulent certificates to impersonate websites and potentially read or modify traffic.
Two trust chains, a broader root removal
Apple’s advisory explains why removing just one root certificate was insufficient. Each of the six affected TLS authorities had two certificates: one chaining through eMudhra’s emSign ECC Root CA - G3, and another cross-signed by Sectigo and chaining through AAA Certificate Services. That made 12 affected TLS intermediate certificates across two trust paths.
The updates block those 12 certificates in the affected command-line tools and remove five roots from /etc/ssl/cert.pem: emSign ECC Root CA - G3, AAA Certificate Services, emSign Root CA - G1, emSign Root CA - C1 and emSign ECC Root CA - C3. The last three extend the root removal beyond the two roots addressed in Apple’s manual workaround.
That broader removal carries a compatibility cost. Apple warns that tools relying only on the file may no longer verify some websites whose certificates chain to the removed roots, including through intermediate authorities unaffected by the compromise. The change cuts off trust paths at a level broader than the compromised intermediates alone.
Apple’s table lists the five roots removed from /etc/ssl/cert.pem by the macOS updates. Source: Apple Support. Source: Apple Support.
eMudhra is leaving publicly trusted TLS services
The issuer’s response goes beyond revoking the affected certificates. In its incident statement, updated November 5, eMudhra acknowledged that a script error produced weak CA keys. It also described a voluntary withdrawal from publicly trusted TLS services and said it was moving TLS customers to alternative providers at no cost to them.
That transition and Apple’s update address different problems: customers need replacement certificate providers, while software must stop trusting the compromised authorities. An issuer’s withdrawal does not itself update the certificate lists already installed on users’ devices.
What administrators still need to check
The fix had already appeared in the macOS 27.3 beta, according to a report on the release. Its inclusion in the November 9 updates makes protection available without waiting for that later version.
For Macs that cannot update, Apple retains instructions for backing up and editing /etc/ssl/cert.pem, requiring administrator access or deployment through device management. Removing emSign ECC Root CA - G3 alone leaves the Sectigo cross-signed path intact; Apple also provides an optional step to remove AAA Certificate Services. It warns administrators to recheck after subsequent software updates in case removed roots return.
After installing one of the three fixed macOS versions, Apple says those manual steps no longer need repeating and warns against restoring a certificate-file backup made before the update.
For organizations, the NHS England alert recommends checking certificate dependencies across applications, containers, development tools and devices, maintaining an asset inventory and applying relevant vendor updates. That broadens the task beyond updating desktop browsers or macOS alone.
The remaining coverage question is application-specific. Apple says some apps and tools use neither its block nor /etc/ssl/cert.pem, instead bundling their own root lists. For those, its advice is to contact the developer. Administrators still need to establish which trust list each deployed application uses and whether its developer has addressed the compromised certificates.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
