Ten days later, Git on macOS still trusts the compromised eMudhra certificates

Right, so it's not just git, it's a bunch of system-provided utilities; macOS trusts bad certs, and these utils that trust the OS are affected. I use homebrew for my git and curl but haven't yet checked to confirm whether that matters here. Kind of outrageous that Apple's guidance is to edit the cert chain manually, and to expect that subsequent OS updates may revert your mitigation, reintroducing the vulnerability (as happened at least once so far).

https://support.apple.com/en-us/149555

> Anyone can intercept any HTTPS connection these tools make.

yeah, it's not ideal but the scale of the threat is way overblown tbh. You have to compromise a lot to be able to make a MITM here.

Let's not treat it like PHP2Shell.

Apple’s statement: https://support.apple.com/en-us/149555

There must be a long list of things that aren’t fully patched for this yet, on laptops, on servers. Think of packages that ship their own trust anchors, isn’t there a rust crate that compiles with some root certs embedded?

On one hand there’s unmaintained packages that won’t update dependencies. On the other hand, fixed dependencies did not necessarily backport to all possible versions in the wild, making update as a fix unviable for those.

If you're not already in the habit of contacting your git remotes over ssh, its probably one worth building. This is gonna keep happening.

I'm not that familiar with the MacOSx system, but do they have a "minor" update path that I'm not aware of? It seems that everything is an 8gb update. Is that why this update isn't getting put out?

Things like this is why I moved back to Linux after 10 years on macOS.

They just released MacOS 27.2 a few days ago? How and why did they not do a patch at least then?

Can we get a title edit? OP’s title implies this is a Git bug, but the bug applies to half of macOS, including curl, openssl, python, perl, and ruby, and to only the macOS version of Git. The original title is less misleading, but personally I’d have titled it something like “macOS still trusts the compromised eMudhra certificates in git, curl, openssl, python3, perl, ruby, more”.

Running (uname -a) Darwin arrakis.local 27.2.0 Darwin Kernel Version 27.2.0: Wed Oct 14 23:47:07 PDT 2026; root:xnu-13432.41.4~25/RELEASE_ARM64_T8132 arm64, I get the following for both:

    curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)    
    More details here: https://curl.se/docs/sslcerts.html

    curl failed to verify the legitimacy of the server and therefore could not
    establish a secure connection to it. To learn more about this situation and
    how to fix it, please visit the webpage mentioned above.

I have been wondering recently if Apple are bothering to maintain the Unix side of the OS. Seems like they occasionally remove or deprecate stuff but don’t put any serious effort into maintenance.

This is just another one of those smells.

That's disingenuous title

It should be "Apple still ships compromised CA in /etc/". Git is just a victim like every other app using system CA

Doesn’t macOS have a way to generate cert.pem from the keychain?

This file is used by a bunch of CLIs. Apple is fundamentally dropping the ball here from a security perspective.

[flagged]