Teku and Besu, software program used to run Ethereum nodes, have shipped Docker safety fixes after a certificate-authority compromise at eMudhra. Operators utilizing affected photos can replace these containers. Binary installations want a separate examine of their Java runtime.
Teku 26.10.3, launched Oct. 27, and Besu 26.10.2, launched Oct. 26, cease their Docker photos trusting 4 certificates roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificates Providers.
For Teku, publicity will depend on configuration. The workforce’s safety discover says default mainnet nodes with out HTTPS URLs are unaffected. On an unremediated runtime, an attacker would want to intercept an affected HTTPS connection to impersonate its endpoint. The discover stories no exploitation.
The underlying incident concerned recoverable personal keys for eight emSign G3 intermediate certificates authorities. eMudhra acknowledged a script error that produced weak keys and stated the intermediates had been revoked after the Oct. 17 report. Teku’s advisory says Java doesn’t examine revocation by default, so affected runtimes nonetheless want their very own remediation.
What operators must examine
The brand new shopper photos deal with their bundled belief shops, the lists of certificates authorities Java accepts. Teku’s discover identifies all its Docker photos by means of 26.10.2, together with the -jdk25 and -jdk26 variants, as retaining the implicated emSign ECC root. Updating Java on the host doesn’t change the runtime inside these containers.
Besu explicitly limits its root-removal change to Docker photos: its tar/zip customers should have a JDK that trusts the roots. Teku’s binary distribution likewise makes use of the Java runtime put in by its operator. These installations want that runtime checked and, if it stays affected, mounted individually from the shopper software program.
Teku’s HTTPS dependencies can embrace distant signers, beacon nodes, execution shoppers and builders or relays, in addition to proposer configuration, startup information and metrics companies. The discover additionally flags Sepolia, Hoodi and Ephemery, which obtain beginning state over HTTPS when launched with an empty database.
On an unremediated runtime, an attacker who intercepts the connection may impersonate a distant beacon node. That might redirect proposal charges or trigger missed validator duties. An attacker impersonating an uncovered exterior signer may receive signatures for validator exits. The discover says mutual TLS shopper authentication on the signer limits its influence to denial of service.
Teku’s peer-to-peer networking, together with libp2p and discv5, doesn’t use certificates authorities and is outdoors this problem.
