Apple's git still trusts the compromised eMudhra certificates

Your git clones and pulls can now be intercepted and replaced with attacker code.

Apple's developer tools, including git, curl, and python3, continue to trust compromised certificates issued by eMudhra, despite Apple being notified on October 17th. As of October 28th, the macOS 13.7 update, released on October 26th, did not address this vulnerability and even reverted manual workarounds applied by users. This means that git connections made via HTTPS to remotes like GitHub can be intercepted, allowing attackers to deliver malicious code, alter in-transit pushes, and steal user credentials. Similarly, curl and python3 are vulnerable to similar man-in-the-middle attacks. While many other open-source projects have released fixes within days of the eMudhra incident, Apple's core developer tools remain exposed, posing a significant supply chain risk.

The prolonged vulnerability in Apple's developer tools signifies a critical gap in its software supply chain security, impacting a vast number of developers who rely on these tools for their daily work. The failure to promptly address the eMudhra certificate compromise, especially after an update reverted user-implemented fixes, highlights a concerning oversight in Apple's security patching process for its developer ecosystem. This delay not only exposes developers to significant risks like code injection and credential theft but also casts doubt on the overall security posture of macOS development environments.

This situation underscores the inherent risks of relying on large, centralized entities for core development infrastructure, as delays in patching can have widespread consequences. Developers must now remain vigilant, repeatedly verifying their tools and re-applying workarounds until Apple provides a permanent solution, which introduces friction and potential for error. Furthermore, organizations utilizing macOS in their CI/CD pipelines face an elevated supply chain risk, necessitating independent security audits and contingency planning to mitigate potential compromises.