Teku and Besu, software program used to run Ethereum nodes, have shipped Docker safety fixes after a certificate-authority compromise at eMudhra. Operators utilizing affected photos can replace these containers. Binary installations want a separate test of their Java runtime.
Teku 26.10.3, launched Oct. 27, and Besu 26.10.2, launched Oct. 26, cease their Docker photos trusting 4 certificates roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificates Companies.
For Teku, publicity will depend on configuration. The group’s safety discover says default mainnet nodes with out HTTPS URLs are unaffected. On an unremediated runtime, an attacker would wish to intercept an affected HTTPS connection to impersonate its endpoint. The discover stories no exploitation.
The underlying incident concerned recoverable personal keys for eight emSign G3 intermediate certificates authorities. eMudhra acknowledged a script error that produced weak keys and stated the intermediates had been revoked after the Oct. 17 report. Teku’s advisory says Java doesn’t test revocation by default, so affected runtimes nonetheless want their very own remediation.
What operators must test
The brand new shopper photos handle their bundled belief shops, the lists of certificates authorities Java accepts. Teku’s discover identifies all its Docker photos by means of 26.10.2, together with the -jdk25 and -jdk26 variants, as retaining the implicated emSign ECC root. Updating Java on the host doesn’t change the runtime inside these containers.
Besu explicitly limits its root-removal change to Docker photos: its tar/zip customers should still have a JDK that trusts the roots. Teku’s binary distribution likewise makes use of the Java runtime put in by its operator. These installations want that runtime checked and, if it stays affected, mounted individually from the shopper software program.
Teku’s HTTPS dependencies can embody distant signers, beacon nodes, execution purchasers and builders or relays, in addition to proposer configuration, startup knowledge and metrics providers. The discover additionally flags Sepolia, Hoodi and Ephemery, which obtain beginning state over HTTPS when launched with an empty database.
On an unremediated runtime, an attacker who intercepts the connection may impersonate a distant beacon node. That might redirect proposal charges or trigger missed validator duties. An attacker impersonating an uncovered exterior signer may acquire signatures for validator exits. The discover says mutual TLS shopper authentication on the signer limits its impression to denial of service.
Teku’s peer-to-peer networking, together with libp2p and discv5, doesn’t use certificates authorities and is exterior this concern.
