eMudhra Intermediate CA Compromise
- Name
- James Brown
Svix's information security team is aware of dangerously-weak intermediate CA certificates issued by the certification authority eMudhra, as described in this branded security release and this bugzilla thread.
The issue affects everyone on the internet, Svix included, and could be used by a network-privileged attacker to issue malicious TLS certificates and intercept traffic.
New images have been released which distrust the Root CAs which signed the affected certificates (emSign ECC Root CA - G3 and Comodo AAA Services) and incorporate the latest versions of rustls-webpki to block any certificate trust chains that go through one of the affected certificates.
Cloud users are already protected. Open-source customers should upgrade to Svix Server v1.102.1. Bridge users should upgrade to Bridge v1.101.0. On-premises Svix Enterprise users using Helm should upgrade to 1.3114. Users of the Svix SDK should use their programming language's package manage to ensure that relevant dependencies are upgraded (e.g., certifi on Python), and should make sure that their operating systems and/or container base images have the latest ca-certificates packages.
If you have any questions or concerns, please don't hesitate to reach out to support@svix.com.
Stay tuned at https://www.svix.com/blog for future posts, follow us on Github, Mastodon, or RSS for the latest updates for the Svix webhook service, or join the discussion on our community Slack.
Are you interested in building build highly-reliable and secure applications for server-to-server communication? Come work with us!
Ready to send webhooks?
Svix is the enterprise ready webhooks service. Build a secure, reliable, and scalable webhook platform in minutes.