Eight intermediate certificates from Indian certificate authority eMudhra (brand emSign) were generated with extremely weak private keys, some being integers below 256, recoverable in less than one second from public certificates. Browsers Chrome, Firefox, Apple and Microsoft blocked these certificates within hours via their revocation lists, but trading bots and Python or Go scripts using the certifi package check no revocation list and remain vulnerable. Approximately 30,000 client certificates must migrate to eMudhra’s RSA root. Experts recommend updating dependencies and never disabling certificate verification to fix errors, as doing so would remove the protection just restored.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
