eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
This is a locked security advisory announcement with no code change requested and no files named in the repository. The payload points to GHSA-m4gc-hcgx-wmc7 and bulletin GCP-2026-075 for the details. A newcomer cannot complete it, so look for a separate open issue that asks for a concrete change.
由索引模型根據 Issue 內容生成。
描述
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages and trust stores are affected
com.google.api-client:google-api-clientearlier than 2.9.2, when the HTTP transport is created withGoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includesAAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.- Google API service library packages (
com.google.apis:google-api-services-*) with a version suffix earlier than-2.9.2, which depend on an affectedgoogle-api-client. - The JDK trust store (
cacerts), used by all other Google client transports, and the Windows certificate store on Windows.
You can take the following actions to resolve these issues
- Upgrade
google-api-clientto 2.9.2 or later, orcom.google.cloud:libraries-bomto 26.91.0 or later. - If your build declares a service library without
google-api-client, upgrade the service library to a release whose version ends in-2.9.2or later (for examplegoogle-api-services-bigquery:v2-rev20260922-2.9.2), or declarecom.google.api-client:google-api-client:2.9.2directly. - If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line:
8.3.1,7.5.2,6.5.12,3.9.19or later; these importlibraries-bom26.91.0. - Apply your JDK vendor's security update.
- On Windows, apply the Windows root certificate update.
Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- 主要語言
- Java
- 星號
- 731
- 分支
- 402
- 平均合併
- 5 小時 43 分鐘
- 30 天內合併 PR
- 959
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
googleapis/google-api-java-client-services 的其他 Issue
-
Google Java API Client Services Readme is missing v1 links for Merchant API it only has the beta links可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉priority: p3 type: docs
難度 1/5 1 小時以內 新手友好度 88/100
googleapis/google-api-java-client-services#32558 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 38/100
googleapis/google-api-java-client-services#33941 ·
維護者通常 1 天內回覆
-
priority: p3
難度 3/5 1-2 天 新手友好度 65/100
googleapis/google-api-java-client-services#32796 · 1 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
-
Javadoc link in google-api-services-admin/directory_v1/README.md returns a 404可能已有人在做 @AbgarSim 於 329 天前認領。 未關閉priority: p3 type: bug
難度 2/5 1-3 小時 新手友好度 50/100
googleapis/google-api-java-client-services#29581 · 2 則留言 ·
維護者通常 1 天內回覆
-
priority: p3 type: feature request
難度 4/5 3-5 天 新手友好度 38/100
googleapis/google-api-java-client-services#29317 · 1 則留言 ·
維護者通常 1 天內回覆
查看 googleapis/google-api-java-client-services 的全部 Issue
相似的 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 78/100
dekobon/big-code-analysis#1913 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
bug:unconfirmed
難度 2/5 1-3 小時 新手友好度 68/100
UniversalMediaServer/UniversalMediaServer#6473 ·
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 82/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
ClickHouse/clickhouse-java#3349 ·
維護者通常 1 天內回覆