eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do

Aberta
  • Algo errado?
#33,811 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
5/100
Tipo de issue
Documentação
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
java
Domínio
security

Direção de pesquisa

This is a locked security advisory announcement with no code change requested and no files named in the repository. The payload points to GHSA-m4gc-hcgx-wmc7 and bulletin GCP-2026-075 for the details. A newcomer cannot complete it, so look for a separate open issue that asks for a concrete change.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

  • com.google.api-client:google-api-client earlier than 2.9.2, when the HTTP transport is created with GoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includes AAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.
  • Google API service library packages (com.google.apis:google-api-services-*) with a version suffix earlier than -2.9.2, which depend on an affected google-api-client.
  • The JDK trust store (cacerts), used by all other Google client transports, and the Windows certificate store on Windows.

You can take the following actions to resolve these issues

  • Upgrade google-api-client to 2.9.2 or later, or com.google.cloud:libraries-bom to 26.91.0 or later.
  • If your build declares a service library without google-api-client, upgrade the service library to a release whose version ends in -2.9.2 or later (for example google-api-services-bigquery:v2-rev20260922-2.9.2), or declare com.google.api-client:google-api-client:2.9.2 directly.
  • If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line: 8.3.1, 7.5.2, 6.5.12, 3.9.19 or later; these import libraries-bom 26.91.0.
  • Apply your JDK vendor's security update.
  • On Windows, apply the Windows root certificate update.

Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.

Linguagem predominante
Java
Estrelas
731
Forks
402
Merge médio
5h 43min
PRs com merge (30d)
959

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de googleapis/google-api-java-client-services

Todas as issues de googleapis/google-api-java-client-services

Issues semelhantes

Mais issues de Java

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.