Skip to content

v2.32.1: Distrust compromised eMudhra intermediate CA certificates

Choose a tag to compare

View all tags
@jdx jdx released this 20 Oct 19:32
· 19 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.32.1
62e3242
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release updates pitchfork's bundled TLS certificate verification so it no longer trusts eight compromised eMudhra intermediate CA certificates.

Fixed

  • Updated TLS root certificates and verifier for the eMudhra CA revocation (#1060) by @jdx. The private keys of eight eMudhra intermediate CA certificates were compromised. Browsers already block them, but software that ships its own root list needs an update. pitchfork now uses rustls-webpki 0.103.16 and webpki-root-certs 1.0.10. TLS connections that depend on those intermediates will now fail, as intended.

Full Changelog: v2.32.0...v2.32.1

💚 Sponsor pitchfork

pitchfork is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If pitchfork has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep pitchfork fast, free, and independent.

Contributors

jdx
Assets 13
Loading