Teku and Besu, software program used to run Ethereum nodes, have shipped Docker safety fixes after a certificate-authority compromise at eMudhra. Operators utilizing affected photos can replace these containers. Binary installations want a separate examine of their Java runtime.
Teku 26.10.3, launched Oct. 27, and Besu 26.10.2, launched Oct. 26, cease their Docker photos trusting 4 certificates roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificates Providers.
For Teku, publicity is dependent upon configuration. The staff’s security notice says default mainnet nodes with out HTTPS URLs are unaffected. On an unremediated runtime, an attacker would want to intercept an affected HTTPS connection to impersonate its endpoint. The discover studies no exploitation.
The underlying incident concerned recoverable non-public keys for eight emSign G3 intermediate certificates authorities. eMudhra acknowledged a script error that produced weak keys and mentioned the intermediates have been revoked after the Oct. 17 report. Teku’s advisory says Java doesn’t examine revocation by default, so affected runtimes nonetheless want their very own remediation.
What operators have to examine
The brand new shopper photos tackle their bundled belief shops, the lists of certificates authorities Java accepts. Teku’s discover identifies all its Docker photos via 26.10.2, together with the -jdk25 and -jdk26 variants, as retaining the implicated emSign ECC root. Updating Java on the host doesn’t change the runtime inside these containers.
Besu explicitly limits its root-removal change to Docker photos: its tar/zip customers should have a JDK that trusts the roots. Teku’s binary distribution likewise makes use of the Java runtime put in by its operator. These installations want that runtime checked and, if it stays affected, mounted individually from the shopper software program.
Teku’s HTTPS dependencies can embrace distant signers, beacon nodes, execution purchasers and builders or relays, in addition to proposer configuration, startup knowledge and metrics providers. The discover additionally flags Sepolia, Hoodi and Ephemery, which obtain beginning state over HTTPS when launched with an empty database.
On an unremediated runtime, an attacker who intercepts the connection might impersonate a distant beacon node. That would redirect proposal charges or trigger missed validator duties. An attacker impersonating an uncovered exterior signer might get hold of signatures for validator exits. The discover says mutual TLS shopper authentication on the signer limits its affect to denial of service.
Teku’s peer-to-peer networking, together with libp2p and discv5, doesn’t use certificates authorities and is outdoors this situation.
