macOS Git Still Trusts Compromised eMudhra CAs After 27.2. How to Fix It
If you run git clone https://... on a stock Mac today, Apple's git still trusts certificates signed with the compromised eMudhra intermediate CA keys, keys that anyone can recover from the public certificates. Firefox and Chrome blocked those certificates on 17 October. Safari followed. /usr/bin/git did not, and as of 28 October it still trusts them . Then macOS 27.2 shipped on 26 October without…
If you run git clone from a standard Mac today, Apple's git still trusts certificates signed with compromised eMudhra intermediate CA keys. These keys are publicly recoverable and were not blocked by browsers as of October 17. The problem stems from the fact that macOS 27.2, released on October 26, did not address the issue, effectively undoing previous workarounds.
To verify if your machine is still vulnerable, you can check the git configuration and the CA bundle it uses. Homebrew's git is not automatically immune to the problem, as it relies on the system CA bundle. To fix the issue, you need to pin the http.sslCAInfo to a patched CA bundle, as updates to the operating system itself did not resolve the vulnerability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Ten days later, Git on macOS still trusts the compromised eMudhra certificates emudhra.we-have-a-problem.com
