eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do

Aperta
  • Qualcosa non va?
#33,811 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
5/100
Tipo di issue
Documentazione
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
java
Ambito
security

Direzione di ricerca

This is a locked security advisory announcement with no code change requested and no files named in the repository. The payload points to GHSA-m4gc-hcgx-wmc7 and bulletin GCP-2026-075 for the details. A newcomer cannot complete it, so look for a separate open issue that asks for a concrete change.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

  • com.google.api-client:google-api-client earlier than 2.9.2, when the HTTP transport is created with GoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includes AAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.
  • Google API service library packages (com.google.apis:google-api-services-*) with a version suffix earlier than -2.9.2, which depend on an affected google-api-client.
  • The JDK trust store (cacerts), used by all other Google client transports, and the Windows certificate store on Windows.

You can take the following actions to resolve these issues

  • Upgrade google-api-client to 2.9.2 or later, or com.google.cloud:libraries-bom to 26.91.0 or later.
  • If your build declares a service library without google-api-client, upgrade the service library to a release whose version ends in -2.9.2 or later (for example google-api-services-bigquery:v2-rev20260922-2.9.2), or declare com.google.api-client:google-api-client:2.9.2 directly.
  • If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line: 8.3.1, 7.5.2, 6.5.12, 3.9.19 or later; these import libraries-bom 26.91.0.
  • Apply your JDK vendor's security update.
  • On Windows, apply the Windows root certificate update.

Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.

Lingua principale
Java
Stelle
731
Fork
402
Merge medio
5h 43m
PR unite (30g)
959

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di googleapis/google-api-java-client-services

Tutte le issue di googleapis/google-api-java-client-services

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.