Intermediate certs allow anyone to mint web credentials for any Internet server.

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.

https://emudhra.we-have-a-problem.com/

Xkcd 221: int getRandomNumber() { return 4; // chosen by fair dice roll. guaranteed to be random. }

  • Die4Ever@retrolemmy.comEnglish
    1131·
    1 day ago

    As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge running on Windows 10, which at the time this article went live was still connecting to 12 vulnerable hosts.

    LOL

    • notthebees@reddthat.comEnglish
      17·
      23 hours ago

      Edge on windows 11 also did it. At least as of last night. My debian boxes are up to date and they have been fixed.

    • Fontasia@feddit.nlEnglish
      4·
      20 hours ago

      Thankfully someone did pull their finger out and get it done an hour later, thankfully Windows also moved to a live CRL requiring no reboots and it’s only hundreds of thousand of unpatched Linux boxes that remain affected 😓

        • Fontasia@feddit.nlEnglish
          1·
          1 hour ago

          Updating is all 😊 just need to make sure you have the latest CA-certificates package

      • Die4Ever@retrolemmy.comEnglish
        2·
        19 hours ago

        my Ubuntu 24.04 server is secured despite not updating anything or rebooting (I have now, but curl was already declining it before)

        $ curl https://ov-g3c-aaa-emudhra.we-have-a-problem.com/
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

        other issues would be software not respecting the system level certs, but that can happen on any OS, it just depends on the program