Apple leaves macOS command-line tools trusting compromised eMudhra certificates
Apple says tools including Git and curl will keep accepting affected certificate chains until a future macOS update; macOS 27.2 did not close the gap.
By Ryan Merket · Published
Primary source: news.ycombinator.com
Why it matters
The affected trust path puts HTTPS Git traffic, which can carry source code and credentials, at risk on developer machines and build workflows.
Apple's macOS command-line tools still accept some certificate chains tied to compromised eMudhra keys, according to a report published October 28th. The gap includes Apple's bundled Git and curl, and the macOS 27.2 update released October 26th did not fix it, the report says.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.