macOS 27.2.1 Fixes eMudhra Certificate Flaw in Command-Line Tools

Apple has released macOS 27.2.1 to address a security vulnerability involving eMudhra certificates in command-line tools. The eMudhra certificates, issued by a certificate authority, had below 256-bit private key values, making them easily recoverable by attackers. These certificates could be used to create fraudulent certificates that appeared valid for any website.

Apple initially blocked these compromised certificates in Safari, Mail, and apps using Apple frameworks in October, but command-line tools like curl and git were still able to accept them. With the update, command-line tools will no longer accept the certificates, preventing potential security risks. Users who cannot update their Macs have the option to manually remove the affected root certificates from the /etc/ssl/cert.pem file.

Apple also provided this workaround in their previous instructions for users who wanted to protect themselves from the compromised certificates. The vulnerability was discovered through an investigation by Mozilla, which found that the private key values used in the certificates were below the recommended 256-bit strength. Apple addressed the issue in the macOS Golden Gate 27.3 beta, but including the fix in macOS 27.2.1 means users won't have to wait until December for protection.