Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Bundled ca-bundle.crt trusts AAA Certificate Services, which cross-signed the compromised eMudhra intermediates

オープン 初心者向け
  • 何か問題がありますか？
#3,460 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
72/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
ruby
領域
backend, security

調査の方向性

gems/aws-sdk-core/ca-bundle.crtから始め、issue内でSHA-256フィンガープリントによって特定されているAAA Certificate Servicesルートを見つけてください。提供された影響を受ける中間証明書、またはAws.use_bundled_cert!を使った再現手順でバンドルを確認してください。侵害された中間証明書を経由する証明書が検証に失敗し、報告されている無関係なAWSエンドポイントの動作には影響がないことを完了条件とします。

索引モデルが issue の本文から書いたものです。

説明

Describe the bug

The private keys of eight eMudhra intermediate CAs (EM DV/OV/EV TLS CA - G3B/G3C, EM OV CS CA - G3B/G3C) have been publicly disclosed as compromised: https://emudhra.we-have-a-problem.com/ (Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Anyone can recover the keys from the certificates. The intermediates were revoked on Oct 18–19, 2026.

Each intermediate was cross-signed by Sectigo's AAA Certificate Services root (SHA-256 D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4). That root is still in gems/aws-sdk-core/ca-bundle.crt (last updated in 2018). Mozilla has already removed it from its root store.

As a result, anyone who calls Aws.use_bundled_cert! trusts TLS certificates issued by any of the compromised intermediates. Ruby/OpenSSL doesn't check revocation by default, so the revocations don't help. An attacker holding one of these keys could impersonate any HTTPS endpoint to those clients. That includes non-AWS endpoints and any custom :endpoint.

This is a different request from #3423. That issue was about new roots missing from the bundle. This one is about a root still in the bundle that now anchors publicly compromised keys.

Regression Issue
  • Select this option if this issue appears to be a regression.
Expected Behavior

With Aws.use_bundled_cert!, certificates chaining to the compromised eMudhra intermediates should fail verification.

Current Behavior

They verify successfully. All 8 Sectigo cross-signed intermediates in the disclosure's impacted-intermediates.json verify against an OpenSSL::X509::Store loaded from ca-bundle.crt. A live TLS connection to the disclosure's test host also succeeds.

Reproduction Steps
require 'aws-sdk-core'
require 'net/http'

http = Net::HTTP.new('dv-g3b-aaa-emudhra.we-have-a-problem.com', 443)
http.use_ssl = true # VERIFY_PEER by default
http.ca_file = Aws.use_bundled_cert!
puts http.request_get('/').code
# => 200 (should raise OpenSSL::SSL::SSLError: certificate verify failed)

For comparison, dv-g3b-emudhra.we-have-a-problem.com (the same intermediate, issued directly by eMudhra's root) correctly fails with unable to get local issuer certificate.

Possible Solution

Either of these fixes it:

  1. Remove AAA Certificate Services from ca-bundle.crt. This is the smallest change.
  2. Regenerate ca-bundle.crt from the current Mozilla/curl bundle (2026-10-20 or later). That bundle drops this root and the emSign roots.

A patch release of aws-sdk-core would help users who rely on Aws.use_bundled_cert!.

Additional Information/Context
  • AWS service endpoints chain to Amazon Trust Services and aren't affected.
  • Users who don't call Aws.use_bundled_cert! use the OS/OpenSSL trust store and should update their system ca-certificates package instead.
Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-core 3.259.0 (version-3 @ 824e96b6d8)

Environment details (Version of Ruby, OS environment)

Ruby 3.4.5 (arm64-darwin24), OpenSSL 3.5.9, macOS 27.0.1. The behavior depends on the bundled file, not the platform.

This issue was generated by AI tools, and reviewed by DewaldoDev

主要言語
Ruby
スター
3.7k
フォーク
1.2k
平均マージ
1日 15時間
マージ済み PR（30日）
24

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

aws/aws-sdk-ruby のほかの issue

aws/aws-sdk-ruby の issue をすべて見る

似ている issue

Ruby の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。