Ethereum Clients Patch Vulnerability Linked to eMudhra Certificates

Vulnerability Discovery

A serious security issue stemming from a cryptographic error at the Indian certificate authority eMudhra has impacted Ethereum's ecosystem. This vulnerability could have enabled attackers to redirect block rewards from validators to their own addresses. The flaw was discovered on October 17, 2023, when it was revealed that private keys for eight of eMudhra’s intermediate certificate authorities were generated with insufficient randomness, allowing potential exploitation.

Updates Released

In response to the vulnerability, Teku, a client used by many Ethereum validators, released version 26.10.3 on October 24, 2023. Besu followed suit with version 26.10.2 on October 23, 2023. Both updates prevent the software from trusting the compromised eMudhra certificates in their Docker images. Validators rely on these certificates to ensure secure communication with services over the internet.

Who is Affected

While default mainnet nodes remain unaffected and require no action, operators running Teku or Besu directly on their machines must manually update their Java installations, as the Ethereum software updates do not alter Java’s list of trusted certificates. Those still using Java version 26 will need to downgrade to version 25, as Teku has indicated that version 26 is no longer supported and will not receive a fix.

Implications for Validators

If exploited, an attacker could impersonate a service connected to a validator, allowing them to propose blocks that redirect rewards to their address. Fortunately, Teku has reported that no exploitation has been detected thus far, and the issue was initially flagged by Consensys Diligence, Teku's security partner.