eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do

Aberta
  • Algo errado?
#14,915 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
Menos de uma hora
Facilidade para iniciantes
12/100
Tipo de issue
Documentação
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
google-cloud, java
Domínio
security

Direção de pesquisa

This is a locked security advisory announcement, not a code task, and the payload names no repository file, test or entry point. Read the linked advisory GHSA-m4gc-hcgx-wmc7 and Google Cloud bulletin GCP-2026-075 to understand the affected google-api-client versions. The issue is locked and asks for questions to go in new issues, so a newcomer should not start work here.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

  • com.google.api-client:google-api-client earlier than 2.9.2, when the HTTP transport is created with GoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includes AAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.
  • Google API service library packages (com.google.apis:google-api-services-*) with a version suffix earlier than -2.9.2, which depend on an affected google-api-client.
  • The JDK trust store (cacerts), used by all other Google client transports, and the Windows certificate store on Windows.

You can take the following actions to resolve these issues

  • Upgrade google-api-client to 2.9.2 or later, or com.google.cloud:libraries-bom to 26.91.0 or later.
  • If your build declares a service library without google-api-client, upgrade the service library to a release whose version ends in -2.9.2 or later (for example google-api-services-bigquery:v2-rev20260922-2.9.2), or declare com.google.api-client:google-api-client:2.9.2 directly.
  • If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line: 8.3.1, 7.5.2, 6.5.12, 3.9.19 or later; these import libraries-bom 26.91.0.
  • Apply your JDK vendor's security update.
  • On Windows, apply the Windows root certificate update.

Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.

Linguagem predominante
Java
Estrelas
2.1k
Forks
1.2k
Merge médio
2d 14h
PRs com merge (30d)
192

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de googleapis/google-cloud-java

Todas as issues de googleapis/google-cloud-java

Issues semelhantes

Mais issues de Java

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.