Teku and Besu, software program used to run Ethereum nodes, have shipped Docker safety fixes after a certificate-authority compromise at eMudhra. Operators utilizing affected pictures can replace these containers. Binary installations want a separate verify of their Java runtime.
Teku 26.10.3, launched Oct. 27, and Besu 26.10.2, launched Oct. 26, cease their Docker pictures trusting 4 certificates roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificates Companies.
For Teku, publicity depends upon configuration. The workforce’s security notice says default mainnet nodes with out HTTPS URLs are unaffected. On an unremediated runtime, an attacker would wish to intercept an affected HTTPS connection to impersonate its endpoint. The discover stories no exploitation.
The underlying incident concerned recoverable non-public keys for eight emSign G3 intermediate certificates authorities. eMudhra acknowledged a script error that produced weak keys and stated the intermediates have been revoked after the Oct. 17 report. Teku’s advisory says Java doesn’t verify revocation by default, so affected runtimes nonetheless want their very own remediation.
What operators must verify
The brand new consumer pictures tackle their bundled belief shops, the lists of certificates authorities Java accepts. Teku’s discover identifies all its Docker pictures by means of 26.10.2, together with the -jdk25 and -jdk26 variants, as retaining the implicated emSign ECC root. Updating Java on the host doesn’t change the runtime inside these containers.
Besu explicitly limits its root-removal change to Docker pictures: its tar/zip customers should still have a JDK that trusts the roots. Teku’s binary distribution likewise makes use of the Java runtime put in by its operator. These installations want that runtime checked and, if it stays affected, fastened individually from the consumer software program.
Teku’s HTTPS dependencies can embrace distant signers, beacon nodes, execution shoppers and builders or relays, in addition to proposer configuration, startup information and metrics providers. The discover additionally flags Sepolia, Hoodi and Ephemery, which obtain beginning state over HTTPS when launched with an empty database.
On an unremediated runtime, an attacker who intercepts the connection may impersonate a distant beacon node. That might redirect proposal charges or trigger missed validator duties. An attacker impersonating an uncovered exterior signer may get hold of signatures for validator exits. The discover says mutual TLS consumer authentication on the signer limits its affect to denial of service.
Teku’s peer-to-peer networking, together with libp2p and discv5, doesn’t use certificates authorities and is outdoors this challenge.
