Skip to content

4.18.4

Latest
Latest

Choose a tag to compare

View all tags
@jeanfbrito jeanfbrito released this 21 Oct 23:37
4.18.4
ad0e195
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a security patch release. Update as soon as possible.

🐛 Fixes

  • Distrust of the compromised eMudhra intermediate CA certificates. The private keys of eight eMudhra intermediate CA certificates are public. With one of these keys, an attacker on your network can impersonate any server. This release updates Electron to 42.11.17 (Chromium 148.0.7778.280). The app now rejects certificates from these intermediates with ERR_CERT_REVOKED. (#3615)
  • No trust prompt for a revoked certificate. Before, the certificate error dialog also let you trust a revoked certificate, and the app remembered that choice. The app now rejects a revoked certificate with no dialog, like Chrome. A server with a self-signed or private-CA certificate still shows the dialog. (#3615)

Details of the compromise: https://emudhra.we-have-a-problem.com/

Assets 29
Loading