With macOS developer tools like git and curl still trusting compromised eMudhra certificates, where should the primary responsibility for security lie?
Apple's macOS Security Gap: The eMudhra Certificate Crisis
A critical security vulnerability persists in macOS developer tools, including git, curl, and python3, following a compromise of eMudhra certificates. Despite Apple being notified of the eMudhra incident on October 17th, essential tools shipped with macOS continue to trust these compromised certificates as of late October. This vulnerability allows attackers to intercept HTTPS connections, alter git pushes and pulls, and potentially steal sensitive credentials like GitHub tokens. The situation is exacerbated by the release of macOS 27.2, which reportedly undid manual workarounds previously applied by users, leaving them vulnerable once again. While Apple has successfully protected Safari and other apps using its networking framework, the core developer ecosystem remains at risk. This creates a significant supply chain risk, particularly for organizations using macOS runners in their CI/CD infrastructure. With many volunteer-led projects having already shipped fixes, the pressure is mounting on Apple to remove the affected roots from /etc/ssl/cert.pem and provide a permanent, automated solution for the developer community.
Options
- Apple must prioritize an official patch for all system developer tools.
- Developers should maintain responsibility for manual tool audits and patches.
- The industry should rely on the quick fixes provided by independent projects.
- Organizations must focus on hardening their CI/CD infrastructure instead.