Mozilla blocks eight compromised eMudhra intermediate certificates
Original title: Protecting Firefox users following the compromise of eMudhra intermediate certificates
OneCRL reached standard Firefox users in under three hours; 158.0.1 and two ESR builds cover the rest.
On October 17, Mozilla was told that private keys for eight eMudhra intermediate certificates had been compromised. Those keys could be used to issue fraudulent HTTPS certificates and, if a connection is intercepted, impersonate sites and read or modify traffic. Mozilla blocked the certificates in OneCRL by 22:59 UTC the same day for Firefox users with standard settings. Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 cover users whose settings blocked OneCRL, and NSS 3.131.1 removes the signing root for other applications using Mozilla’s trust store.
Unconfirmed: Mozilla has not said how the keys were compromised or whether fraudulent certificates were issued.
- Mozilla received the report at 20:06 UTC on October 17.
- OneCRL distribution finished by 22:59 UTC, in less than three hours.
- Desktop and Android Firefox 158.0.1 carry the same protection.
- ESR builds are 115.43.1 and 153.5.1; NSS 3.131.1 drops the root.
Impact: Fraudulent HTTPS certificates that can impersonate websites
| Product | Affected |
|---|---|
| eMudhra intermediate certificates | eight compromised intermediates |
- 1.Install Firefox 158.0.1, ESR 115.43.1, or ESR 153.5.1 if OneCRL did not apply.
- 2.Update applications using Mozilla’s trust store to NSS 3.131.1.
From the original article
1 min read at blog.mozilla.orgOn Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.
By blog.mozilla.org via freddyb · blog.mozilla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.