Ten days later, Git on macOS still trusts the compromised eMudhra certificates

Your Git operations over HTTPS could be unknowingly compromised, exposing your code and credentials to attackers.

Ten days after being notified of a compromised certificate incident involving eMudhra, Apple's developer tools on macOS, including Git, Curl, and Python 3, still trust the affected certificates as of October 28th. macOS 13.2, released on October 26th, failed to address the vulnerability and even reverted manual user workarounds. This oversight leaves Git users susceptible to code injection through compromised HTTPS connections, alterations of code pushes, and interception of credentials like GitHub tokens. While numerous other open-source projects rapidly deployed fixes, Apple's core developer utilities remain vulnerable, posing a significant supply chain risk. Users can test their Git installations by attempting to clone a specific test repository; a successful clone indicates a vulnerability, while a certificate error signifies protection.

Apple's delayed response to the eMudhra certificate compromise highlights a potential vulnerability in its supply chain security for developer tools. The fact that a macOS update actively reverted user-implemented workarounds exacerbates the issue, suggesting a systemic oversight in patch testing or deployment. This situation creates a significant risk for developers relying on Apple's ecosystem, as their code repositories and sensitive credentials are now potentially exposed.

The ongoing vulnerability in Git on macOS underscores the critical need for timely security updates across all software, especially developer infrastructure. Organizations using macOS for CI/CD pipelines or other build processes should immediately audit their systems and consider manual mitigation steps until Apple provides a permanent fix. The incident also serves as a stark reminder of the trust placed in root certificate authorities and the cascading impact when that trust is broken.