We have released security updates in response to the eMudhra certificate compromise. We recommend upgrading each Tuist component you use to the patched release listed below.
What is the risk?
When an application connects over HTTPS, it checks a certificate to confirm that it is talking to the right server. Certificate authorities are the organizations trusted to vouch for those certificates.
Compromised eMudhra certificate keys can be used to create forged certificates that some applications still trust. An attacker who can intercept a connection could use one to impersonate the intended server and read or change data sent over that connection, including credentials. This is often called a man-in-the-middle attack.
The problem concerns how applications verify the other end of a connection, not a break in TLS encryption itself. Different applications can use different certificate stores, so updating a browser or an operating system alone does not necessarily protect every application.
What we changed
The updates reject certificate chains that use the affected keys and update shipped certificate stores where applicable. Normal certificate and hostname verification remain enabled, and unrelated private certificate authorities remain supported.
The fix is available in these stable patch releases:
These versions identify the patched releases on their respective stable release lines. Updating a self-hosted server does not update installed clients, and updating a client does not update a self-hosted server.
What you should do
- Upgrade each component you use, including versions pinned in CI and project dependencies.
- Restart running clients and replace or recreate server and Kura containers with the fixed versions. Changing an image tag does not update an already-running container. Follow your normal upgrade and rollout checks.
- Keep your operating system and TLS libraries updated as well.
- If an endpoint starts failing certificate checks, repair its certificate chain. Do not disable certificate verification to work around the error.
If you need the fix backported to an older release line, contact us with the component and version you run.
What about past connections?
The updates address the risk of future connections trusting the affected keys. They do not establish whether a past connection was intercepted. Certificate-based impersonation may not leave a clear trace in application logs, so an absence of reports or log entries would not prove that no interception occurred.
If you suspect exposure, contact us so we can help assess your situation and any additional steps needed.