Protecting Firefox users following the compromise of eMudhra intermediate certificates

On October 17, at 20:06 UTC, Mozilla received notification that the private keys linked to eight eMudhra intermediate certificates had been compromised. These compromised keys could enable attackers to create false HTTPS certificates for websites they do not own. If a user's connection is intercepted, the attacker could use these forged certificates to masquerade as legitimate websites, potentially gaining access to sensitive data being transmitted.

Reacting swiftly, Mozilla's engineers employed OneCRL, Mozilla's centralized list of revoked certificates, to block the affected certificates in the Firefox browser. This protective measure can be implemented without the need for users to update or restart Firefox. Remarkably, within three hours of receiving the report, the enhanced OneCRL distribution was successfully installed for all standard Firefox users.

In an effort to extend this security enhancement to a smaller subset of users with custom settings that may have hindered the OneCRL update, Mozilla has released new versions of Firefox. These include Firefox 158.0.1 for desktop and Android, along with Firefox ESR (Extended Support Release) versions 115.43.1 and 153.5.1. These updates will provide the necessary protection to these remaining users.

Additionally, Mozilla is updating the trusted certificate list within the NSS (Network Security Configuration) to remove the root certificate that signed the compromised intermediates. This action aims to safeguard not only Firefox but also other applications that rely on Mozilla's trust store or its derivatives.

Mozilla firmly believes in the inherent right to security and privacy online. This incident underscores their unwavering commitment to defending these rights and taking prompt action to protect users. They emphasize the importance of transparency in maintaining trust, vowing to provide further details as the situation permits.