macOS git still trusts compromised eMudhra certificates after 10 days
Original title: Ten days later, Git on macOS still trusts the compromised eMudhra certificates
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
A community site says Apple was notified of the eMudhra certificate compromise on October 17, but as of October 28 the developer tools shipped with macOS, including git, curl, and python3, still trust the compromised certificates. macOS 27.2, released October 26, did not fix the issue and reversed hand-applied workarounds. The authors say an on-path attacker can intercept HTTPS used by those tools, altering git clones and pulls and capturing credentials such as GitHub tokens. Safari and apps on Apple's networking framework are already protected.
Unconfirmed: The page demonstrates interception is possible; it does not report confirmed real-world attacks on developers.
- Apple was notified on October 17; the check date is October 28.
- A successful clone of the authors' test repo shows git is affected.
- The suggested fix is removing the affected roots from /etc/ssl/cert.pem.
- Apple guidance says OS updates may restore the roots, so checks must be repeated.
- The authors urge teams to review macOS runners in CI and build systems.
Impact: Intercept HTTPS and deliver attacker-chosen code via git
| Product | Affected |
|---|---|
| Apple macOS | macOS 27.2 and developer tools shipped with macOS, including git, curl, and python3 |
| eMudhra certificates | compromised intermediates still trusted by Apple developer tools |
- 1.Remove the affected roots from /etc/ssl/cert.pem using the site's macOS workaround.
- 2.Repeat the git and curl checks and the workaround after every macOS update.
- 3.Review whether macOS runners are used in CI or other build infrastructure.
From the original article
2 min read at emudhra.we-have-a-problem.comApple was notified of the eMudhra incident on 17th October. As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates. Worse, macOS 27.
By galadran · emudhra.we-have-a-problem.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.