Apple's git still trusts the compromised eMudhra certificates

Apple was notified of the eMudhra incident on 17th October. As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates.

苹果公司于 10 月 17 日获悉了 eMudhra 事件。截至 10 月 28 日，苹果随 macOS 发布的开发工具（包括 git、curl 和 python3）仍然信任这些受损的证书。

Worse, macOS 27.2, released on 26th October, did not fix the issue and undid the workaround that users had applied by hand, leaving them vulnerable again.

更糟糕的是，10 月 26 日发布的 macOS 27.2 不仅没有修复该问题，反而撤销了用户手动应用的临时解决方案，使他们再次面临风险。

Meanwhile, dozens of other projects, many run by volunteers, shipped fixes days ago.

与此同时，其他数十个项目（其中许多由志愿者运营）早在几天前就发布了修复程序。

Anyone can intercept any HTTPS connection these tools make.

任何人都可以拦截这些工具发起的任何 HTTPS 连接。

For git, that means clones and pulls from https:// remotes can deliver attacker-chosen code, pushes can be altered in transit, and your credentials, such as GitHub tokens, can be intercepted.

对于 git 而言，这意味着从 https:// 远程仓库进行的克隆（clone）和拉取（pull）操作可能会被植入攻击者指定的代码，推送（push）操作在传输过程中可能会被篡改，而您的凭据（例如 GitHub 令牌）也可能被拦截。

To check whether your git is affected, run:

要检查您的 git 是否受到影响，请运行：

A certificate error means your git is protected. If git lists a commit, your git is affected. Your connections to GitHub, or any other https:// git remote, can be intercepted and tampered with.

如果出现证书错误，说明您的 git 是受保护的。如果 git 列出了提交记录，则说明您的 git 受到影响。您与 GitHub 或任何其他 https:// git 远程仓库的连接都可能被拦截和篡改。

To see an attack end to end, run the command below in a temporary directory. It clones a repository from a test server impersonating GitHub. The -c option redirects github.com to our test server for this one command only. The server presents a github.com certificate issued by one of the compromised eMudhra intermediates.

要查看完整的攻击过程，请在临时目录中运行以下命令。它会从一台冒充 GitHub 的测试服务器克隆一个存储库。-c 选项仅针对此条命令将 github.com 重定向到我们的测试服务器。该服务器会出示一张由受损的 eMudhra 中间证书颁发机构签发的 github.com 证书。

A patched git will refuse with a certificate error. If the clone succeeds, you’ll see a README.md starting with INTERCEPTED.

已打补丁的 git 会因证书错误而拒绝连接。如果克隆成功，您将看到一个以“INTERCEPTED”（已拦截）开头的 README.md 文件。

A real attacker would not need the extra option. Anyone on the network path between you and GitHub can redirect your traffic themselves.

真正的攻击者不需要额外的选项。任何处于您与 GitHub 之间网络路径上的攻击者都可以自行重定向您的流量。

You can replace the demo repository with any other, public or private. Keep the fake-user@ prefix. Without it, git would send your GitHub credentials to the test server. For example:

您可以将演示存储库替换为任何其他公共或私有存储库。请保留 fake-user@ 前缀。如果没有它，git 会将您的 GitHub 凭据发送到测试服务器。例如：

curl, python3 and the other tools Apple ships are affected in the same way. To check curl, run:

curl、python3 以及苹果随附的其他工具也受到同样的影响。要检查 curl，请运行：

A certificate error means curl is protected.

如果出现证书错误，说明 curl 是受保护的。

Apple has already protected Safari and other apps built on its networking framework.

苹果公司已经保护了 Safari 以及其他基于其网络框架构建的应用程序。

Apple needs to ship a fix for macOS developers as soon as possible, for example by removing the affected roots from /etc/ssl/cert.pem.

苹果公司需要尽快为 macOS 开发者发布修复程序，例如通过从 /etc/ssl/cert.pem 中移除受影响的根证书。

The affected roots can be removed by hand. The macOS workaround on the main page walks through the steps. Apple’s guidance states that macOS updates may revert the fix, so developers need to repeat the checks above and the workaround after every update until Apple ships a fix.

受影响的根证书可以手动移除。主页上的 macOS 临时解决方案详细介绍了具体步骤。苹果的指南指出，macOS 更新可能会撤销该修复，因此在苹果发布正式修复程序之前，开发者需要在每次更新后重复上述检查和临时解决方案。

Security teams should also consider whether macOS runners are used in their CI or other build infrastructure and evaluate the supply chain risk.

安全团队还应考虑其 CI 或其他构建基础设施中是否使用了 macOS 运行器（runners），并评估供应链风险。

Site published by Dennis Jackson. This site is the work of many contributors from the community. The source is on GitHub and PRs are welcome. Licensed under the Apache License, Version 2.0.

本网站由 Dennis Jackson 发布。本网站是社区中许多贡献者的心血结晶。源代码托管在 GitHub 上，欢迎提交 PR。采用 Apache License 2.0 协议授权。