From 888abba9dd2ee27fbe73361905c680c5dd741371 Mon Sep 17 00:00:00 2001 From: greaker <152405392+Greaker@users.noreply.github.com> Date: Thu, 22 Oct 2026 14:47:06 +0200 Subject: [PATCH] Distrust compromised eMudhra CA: Foundry v1.8.6, BENS python 3.14.9 In October 2026 the private keys of eight eMudhra intermediate CAs became derivable from their certificates. Mozilla removed emSign ECC Root CA - G3 in NSS 3.131.1, and Debian also distrusted AAA Certificate Services. Any trust store still holding either root accepts the compromised intermediates. Contracts CI moves Foundry from v1.7.1 to v1.8.6, which ships rustls-webpki 0.103.16 and webpki-roots 1.0.10; CI downloads solc and Soldeer dependencies over TLS. The BENS build and runtime base moves from python:3.14.8 to 3.14.9. It bundles pip 26.2.2, whose vendored certifi 2026.10.19 drops the root; pip 26.2.1 still trusted it next to the system store during the image's pip install. The system bundle is Debian ca-certificates 20250419+deb13u1. The Node pin (26.12.1) already carries the NSS 3.131.1 roots. docs/KNOWN_ISSUES.md records the third-party images that still trust the root and are waiting on upstream releases. The one that matters most is the smart-contract verifier, which downloads Solidity compilers over TLS through an Ubuntu bundle that still holds it. Verified: python:3.14.9 and a BENS image built from it contain none of the affected roots; forge 1.8.6 passes soldeer install, fmt --check, build --sizes, the verify-mapping check and 355 tests; the hygiene, link, licence, node-version, Besu baseline and image-hash checks pass. --- .github/workflows/test-contracts.yml | 2 +- common/helpers.sh | 2 +- common/images.yaml | 2 +- docs/KNOWN_ISSUES.md | 42 +++++++++++++++++++ .../blockscout/bens-microservice/Dockerfile | 4 +- services/blockscout/values.yaml | 2 +- 6 files changed, 48 insertions(+), 6 deletions(-) diff --git a/.github/workflows/test-contracts.yml b/.github/workflows/test-contracts.yml index 6f20881..3165352 100644 --- a/.github/workflows/test-contracts.yml +++ b/.github/workflows/test-contracts.yml @@ -32,7 +32,7 @@ jobs: - name: Install Foundry uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 with: - version: v1.7.1 + version: v1.8.6 - name: Show Forge version run: | diff --git a/common/helpers.sh b/common/helpers.sh index 08ab9d9..74d6d46 100755 --- a/common/helpers.sh +++ b/common/helpers.sh @@ -38,7 +38,7 @@ BLOCKSCOUT_DIR=$REPO_ROOT/services/blockscout BLOCKSCOUT_TMPDIR=$BLOCKSCOUT_DIR/.tmp BLOCKSCOUT_CHART_VERSION=4.5.3 BLOCKSCOUT_BENS_DIR=$BLOCKSCOUT_DIR/bens-microservice -BENS_BASEIMAGE=python:3.14.8 +BENS_BASEIMAGE=python:3.14.9 NB_BOND_API_NAMESPACE=nb-bond-api NB_BOND_API_DIR=$REPO_ROOT/services/nb-bond-api diff --git a/common/images.yaml b/common/images.yaml index fba9c95..61238b3 100644 --- a/common/images.yaml +++ b/common/images.yaml @@ -40,7 +40,7 @@ blockscout: backend: ghcr.io/blockscout/blockscout:v11.2.6 frontend: ghcr.io/blockscout/frontend:v2.10.3 db: postgres:18.6 - bens: python:3.14.8 + bens: python:3.14.9 # Smart-contract verification microservice. Modern Blockscout delegates # source compilation / bytecode matching to this standalone service; the # backend (v10 and later) does not verify in-process. GPL-3.0, same as the diff --git a/docs/KNOWN_ISSUES.md b/docs/KNOWN_ISSUES.md index 9c692d1..a1ad05f 100644 --- a/docs/KNOWN_ISSUES.md +++ b/docs/KNOWN_ISSUES.md @@ -18,6 +18,48 @@ lockfile diff (parse both lockfiles and compare entries) — the changed entry set must be exactly the intended packages. +## Third-party images still trust the compromised eMudhra CA root (October 2026) +- In October 2026 the private keys of eight eMudhra intermediate CAs became + derivable from their public certificates + ([Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)). + Mozilla removed **"emSign ECC Root CA - G3"** in NSS 3.131.1, and Sectigo revoked + the intermediates' cross-signs from "AAA Certificate Services". Debian also + distrusted that root. A trust store that still holds either root accepts + certificates from the compromised intermediates. +- Fixed in this repository: the Node pin (26.12.1, built-in roots from NSS 3.131.1 + plus a block on the intermediates' keys), the BENS base image (`python:3.14.9`: + Debian `ca-certificates 20250419+deb13u1` and pip 26.2.2 with certifi + 2026.10.19), and Foundry in Contracts CI (v1.8.6: `rustls-webpki` 0.103.16, + `webpki-roots` 1.0.10). +- Still exposed, waiting on upstream releases (checked 2026-10-22): + + | Component (pin) | Store that still holds the root | Outbound TLS | Waiting for | + |---|---|---|---| + | `smart-contract-verifier` (`v1.11.0`) | Ubuntu 24.04 `ca-certificates 20260601~24.04.1`, used through OpenSSL | **Yes**: downloads Solidity compilers from `binaries.soliditylang.org` | An image built on the fixed Ubuntu `ca-certificates` | + | Blockscout backend (`v11.2.6`) | `castore` 1.0.20 and Erlang `certifi` 2.15.0 in the release, Alpine `ca-certificates 20250911-r0` | Little: market data is disabled; token metadata fetches can leave the cluster | A Blockscout release with `castore` ≥ 1.0.22 (v12.0.3 still pins 1.0.21) | + | Blockscout frontend (`v2.10.3`) | Node 22.14.0 built-in roots (also "AAA Certificate Services") | No (in-cluster backend only) | A release on Node ≥ 22.23.4 / 24.22.1 (v2.12.1 uses 24.21.0) | + | Besu (`26.10.0`) | Temurin 25.0.3 `cacerts` | No (P2P is not TLS; discovery is off) | A JDK update that blocks the intermediates; the October 2026 JDK updates do not | + | Kind node (`kindest/node:v1.32.11`) | Debian 12 `ca-certificates 20230311+deb12u1` (also "AAA Certificate Services"); containerd built with Go 1.25.5 | **Yes**: containerd pulls images that are not in the local registry | A kind node image built on the fixed Debian `ca-certificates` | + | NGINX Gateway Fabric (`2.8.0`, control plane and nginx) | Distroless Debian bundle (also "AAA Certificate Services") with Go 1.27.2; Alpine `ca-certificates 20260909-r0` | No (Kubernetes API and in-cluster upstreams only) | A release on Go ≥ 1.27.3 and Alpine `ca-certificates 20261020-r0` | + | `nginxinc/nginx-unprivileged` (`1.30.6-alpine`, NB UI runtime) | Alpine `ca-certificates 20260909-r0` | No (serves static files) | A tag rebuilt on Alpine `ca-certificates 20261020-r0` | + | Local registry (`registry:2.8.3`) | Alpine 3.18 `ca-certificates 20241121-r1` (also "AAA Certificate Services") | No (no pull-through proxy) | A `registry` image on Alpine `ca-certificates 20261020-r0` (3.1.2 is not yet) | + | `crytic/slither-action` (Contracts CI) | Not checked (image not inspected) | Yes: downloads `solc` | Check when the action next releases | + +- To re-check a bundle, count it as exposed only when it contains one of the + affected roots: + + ```bash + openssl storeutl -noout -text -certs \ + | grep -E 'Subject:.*(emSign (Root TLS|Root CS|ECC Root) CA - G3|AAA Certificate Services)' + ``` + + For an image, `docker create` it and `docker cp` its + `/etc/ssl/certs/ca-certificates.crt` out, so nothing inside it runs. Language + runtimes that ship their own list (Node's `tls.rootCertificates`, JDK `cacerts`, + `castore`, `certifi`) need their own check. +- Follow-up: move each pin once its upstream fix is published, and remove this + item when the table is empty. + ## Order-book makers that fail settlement with an unknown reason stay resting - `OrderBook` keeps a resting maker in place when `DvP.settle` fails with `FailureReason.Unknown` (a revert the settlement contract cannot attribute diff --git a/services/blockscout/bens-microservice/Dockerfile b/services/blockscout/bens-microservice/Dockerfile index d03bc59..4dd4a26 100644 --- a/services/blockscout/bens-microservice/Dockerfile +++ b/services/blockscout/bens-microservice/Dockerfile @@ -13,8 +13,8 @@ # and pre-pulled by `./infra/infra.sh registry-sync` so an offline build # works. -ARG BENS_BUILDER_IMAGE=python:3.14.8 -ARG BENS_RUNTIME_IMAGE=python:3.14.8 +ARG BENS_BUILDER_IMAGE=python:3.14.9 +ARG BENS_RUNTIME_IMAGE=python:3.14.9 FROM ${BENS_BUILDER_IMAGE} AS builder WORKDIR /build diff --git a/services/blockscout/values.yaml b/services/blockscout/values.yaml index 5d00ee2..6c06d2f 100644 --- a/services/blockscout/values.yaml +++ b/services/blockscout/values.yaml @@ -4,7 +4,7 @@ # Fallback image tags (standard sandbox scripts override from common/images.yaml) dbImage: postgres:18.6 -bensImage: python:3.14.8 +bensImage: python:3.14.9 # Overwrites default values based on : https://github.com/blockscout/helm-charts/blob/blockscout-stack-4.5.3/charts/blockscout-stack/values.yaml config: