Teku 26.10.3, released on October 27, and Besu 26.10.2, released on October 26, remove four compromised certificate roots from their Docker images: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services. Binary installations are not fixed by these updates because they rely on separately managed Java that operators must inspect and upgrade if necessary. The underlying incident involved eight emSign G3 intermediate certificate authorities whose recoverable private keys were generated because of a script error; the intermediates were revoked after the October 17 report. Teku reports no exploitation and states that default mainnet nodes without HTTPS URLs are unaffected. On an unremediated system, intercepting an HTTPS connection could redirect proposal fees, cause missed validator duties, or obtain validator exit signatures; Teku’s peer-to-peer networking, including libp2p and discv5, is outside the issue.
Source: Read the original article
