Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Bundled ca-bundle.crt trusts AAA Certificate Services, which cross-signed the compromised eMudhra intermediates

Cerrado Apto para principiantes
  • ¿Algo no está bien?
#3,460 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Ya se ha fusionado un pull request relacionado.

  • #3461 de @dscpinheiro — fusionado

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
ruby
Área
backend, security

Línea de trabajo

Empieza con gems/aws-sdk-core/ca-bundle.crt y localiza la raíz de AAA Certificate Services identificada por su huella SHA-256 en el issue. Comprueba el bundle con los intermediarios afectados proporcionados o con la reproducción usando Aws.use_bundled_cert!. Se considera terminado cuando los certificados cuya cadena pasa por los intermediarios comprometidos no superan la verificación y el comportamiento reportado de los endpoints de AWS no relacionados sigue sin verse afectado.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

The private keys of eight eMudhra intermediate CAs (EM DV/OV/EV TLS CA - G3B/G3C, EM OV CS CA - G3B/G3C) have been publicly disclosed as compromised: https://emudhra.we-have-a-problem.com/ (Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Anyone can recover the keys from the certificates. The intermediates were revoked on Oct 18–19, 2026.

Each intermediate was cross-signed by Sectigo's AAA Certificate Services root (SHA-256 D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4). That root is still in gems/aws-sdk-core/ca-bundle.crt (last updated in 2018). Mozilla has already removed it from its root store.

As a result, anyone who calls Aws.use_bundled_cert! trusts TLS certificates issued by any of the compromised intermediates. Ruby/OpenSSL doesn't check revocation by default, so the revocations don't help. An attacker holding one of these keys could impersonate any HTTPS endpoint to those clients. That includes non-AWS endpoints and any custom :endpoint.

This is a different request from #3423. That issue was about new roots missing from the bundle. This one is about a root still in the bundle that now anchors publicly compromised keys.

Regression Issue
  • Select this option if this issue appears to be a regression.
Expected Behavior

With Aws.use_bundled_cert!, certificates chaining to the compromised eMudhra intermediates should fail verification.

Current Behavior

They verify successfully. All 8 Sectigo cross-signed intermediates in the disclosure's impacted-intermediates.json verify against an OpenSSL::X509::Store loaded from ca-bundle.crt. A live TLS connection to the disclosure's test host also succeeds.

Reproduction Steps
require 'aws-sdk-core'
require 'net/http'

http = Net::HTTP.new('dv-g3b-aaa-emudhra.we-have-a-problem.com', 443)
http.use_ssl = true # VERIFY_PEER by default
http.ca_file = Aws.use_bundled_cert!
puts http.request_get('/').code
# => 200 (should raise OpenSSL::SSL::SSLError: certificate verify failed)

For comparison, dv-g3b-emudhra.we-have-a-problem.com (the same intermediate, issued directly by eMudhra's root) correctly fails with unable to get local issuer certificate.

Possible Solution

Either of these fixes it:

  1. Remove AAA Certificate Services from ca-bundle.crt. This is the smallest change.
  2. Regenerate ca-bundle.crt from the current Mozilla/curl bundle (2026-10-20 or later). That bundle drops this root and the emSign roots.

A patch release of aws-sdk-core would help users who rely on Aws.use_bundled_cert!.

Additional Information/Context
  • AWS service endpoints chain to Amazon Trust Services and aren't affected.
  • Users who don't call Aws.use_bundled_cert! use the OS/OpenSSL trust store and should update their system ca-certificates package instead.
Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-core 3.259.0 (version-3 @ 824e96b6d8)

Environment details (Version of Ruby, OS environment)

Ruby 3.4.5 (arm64-darwin24), OpenSSL 3.5.9, macOS 27.0.1. The behavior depends on the bundled file, not the platform.

This issue was generated by AI tools, and reviewed by DewaldoDev

Lenguaje dominante
Ruby
Estrellas
3.7k
Forks
1.2k
Merge medio
1 d 16 h
PR fusionados (30 d)
25

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aws/aws-sdk-ruby

Todos los issues de aws/aws-sdk-ruby

Issues similares

Más issues de Ruby

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.