Protecting Firefox users following the compromise of eMudhra intermediate certificates
Protecting Firefox users following the compromise of eMudhra intermediate certificates
On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.
10月17日星期六协调世界时20:06，Mozilla收到报告称，与八个eMudhra中间证书相关的私钥遭到泄露。这些密钥可能允许攻击者为其无法控制的网站签发欺诈性的HTTPS证书。能够拦截用户连接的攻击者可以利用这些证书冒充网站，并可能读取或修改流量。
Mozilla engineers responded immediately, blocking the affected certificates in Firefox using OneCRL, Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox. By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations.
Mozilla工程师立即做出响应，使用Mozilla的集中式吊销证书列表OneCRL在Firefox中封锁了受影响的证书。OneCRL无需用户更新或重启Firefox即可提供此项保护。当天协调世界时22:59，即我们收到报告后不到3小时，所有采用标准配置的Firefox用户均已完成更新后的OneCRL分发。
Today, we are also releasing Firefox 158.0.1 for Desktop and Android, along with Firefox ESR 115.43.1 and Firefox ESR 153.5.1. These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update. We are also updating the trusted certificate list in NSS (NSS 3.131.1) to remove the root certificate that signed the affected intermediates.
今天，我们还发布了适用于桌面端和Android端的Firefox 158.0.1，以及Firefox ESR 115.43.1和Firefox ESR 153.5.1。这些版本将为少数因自定义设置而可能无法接收OneCRL更新的用户提供此项保护。我们还在更新NSS（NSS 3.131.1）中的受信任证书列表，以移除签署受影响中间证书的根证书。
Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates. Mozilla believes everyone has a fundamental right to security and privacy online. We remain committed to defending those rights and acting quickly to protect users. Transparency is essential to trust. We will share more information as soon as circumstances allow.
Firefox已通过OneCRL获得保护，但此次额外更新有助于保护其他使用Mozilla信任存储或其衍生版本且无法接收OneCRL更新的应用程序。Mozilla坚信每个人在网络上都享有安全和隐私的基本权利。我们始终致力于捍卫这些权利，并迅速采取行动保护用户。透明度对于信任至关重要。我们将在情况允许时分享更多信息。