Teku and Besu release security fixes after eMudhra certificate compromise

Teku and Besu, Ethereum node software, have released Docker security updates following a certificate authority compromise at eMudhra. Affected operators can update their containers, while binary installations require a separate check of their Java runtime. Teku 26.10.3, released on Oct. 27, and Besu 26.10.2, released on Oct. 26, stop trusting four compromised certificate roots. Teku's exposure depends on configuration; default mainnet nodes without HTTPS URLs are unaffected. An attacker would need to intercept an HTTPS connection to exploit an unremediated runtime, but no exploitation has been reported. The incident involved recoverable private keys for eight emSign G3 intermediate certificate authorities, with eMudhra acknowledging a script error that produced weak keys. The intermediates were revoked after the Oct. 17 report. Operators must check their Java runtimes, as Teku's advisory states that Java does not check revocation by default. Teku's Docker images through 26.10.2 retain the compromised root, and updating Java on the host does not affect the runtime in those containers. Besu limits its root-removal change to Docker images, while tar/zip users may still have a JDK that trusts the roots. Teku's HTTPS dependencies include remote signers and beacon nodes, and an unremediated runtime could allow attackers to impersonate these services, potentially redirecting proposal fees or causing missed validator duties. Mutual TLS client authentication at the signer limits the impact to denial of service.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.