Multiple tech giants urgently block 8 vulnerable intermediate certificates under eMudhra

Odaily reports: Multiple tech companies have urgently blocked 8 intermediate certificates with security vulnerabilities issued by Indian digital certificate authority eMudhra Limited. Due to flaws in the private key generation process of the affected certificates, attackers could exploit forged certificates to impersonate legitimate websites and intercept, read, or tamper with user communications.

Mozilla cryptography engineer Dennis Jackson stated in an incident report that after receiving the vulnerability report on October 17, Mozilla independently recovered the relevant private keys, confirming that the generation mechanism has serious flaws and is highly exploitable.

Mozilla subsequently blocked the affected certificates in Firefox through OneCRL and released browser updates for desktop and Android on October 20. Cloudflare also updated protections for services including Cloudflare One, WARP client, and Cloudflare Tunnel on Tuesday. According to Mozilla's disclosure, Chrome blocked the relevant certificates on Saturday, Apple devices completed blocking on Monday, and Microsoft platforms took corresponding measures on Tuesday. (Cointelegraph)