macOS tools still trust compromised eMudhra certificates; Apple told 11 days ago
The git, curl and python3 tools bundled with macOS still trust certificates from the certificate authority eMudhra, whose keys anyone can recover, researchers say. Apple was told 11 days ago and has shipped no fix; macOS 27.2 even wiped manually applied fixes. An attacker on the same network can pose as GitHub and feed malicious code.
What happened
The git, curl and python3 tools bundled with macOS still accept certificates from the certificate authority eMudhra, whose keys anyone can recover, according to researchers. Apple was notified 11 days ago and has released no fix. Macs used to fetch code, such as from GitHub, are exposed.
Why it matters
Anyone on the same network can impersonate GitHub or another service and deliver malicious code to developers and macOS machines. That can lead to breaches, data theft or compromised software shipped to customers. There is no official fix, and a recent system update removed manual mitigations.
What to do
Manually remove the eMudhra certificates from macOS trust stores and re-check after every system update, as macOS 27.2 wiped hand-applied fixes. Restrict use of the bundled git, curl and python3 on untrusted networks until Apple ships a fix.
For the technical team
- Affected
- Apple macOS (ferramentas git, curl e python3 incluídas no sistema) · macOS (bundled git, curl and python3 tools). Researchers report macOS 27.2 wiped manually applied fixes.
- Exploitation
- No fix from Apple 11 days after notification, per researchers (report via @IntCyberDigest). No in-the-wild exploitation reported in the sources.
- Fix
- No official fix known. Researchers report macOS 27.2 removed manual fixes, so manual mitigation must be reapplied and rechecked after updates.
- Vector
- The git, curl and python3 tools bundled with macOS trust eMudhra CA certificates; the CA keys can be recovered by anyone. Exploitation condition: attacker on the same network as the victim, MITM, impersonating services like GitHub to deliver malicious code.
- More details
- Cited chain: recovery of eMudhra keys, GitHub impersonation and delivery of malicious code to users of the bundled git, curl or python3. No CVE, tool versions or Apple timeline cited in the sources. Discovery attributed to researchers, with no names given in the source.
Timeline
Researchers report that macOS tools still trust compromised eMudhra certificates, with no fix from Apple.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
