Mozilla blocks eight compromised eMudhra certificates in Firefox
Mozilla blocked eight compromised eMudhra intermediate certificates in Firefox via OneCRL within hours, then shipped updates and revised NSS trust lists.
The story in focus
Mozilla says private keys for eight eMudhra intermediate certificates were compromised, which could let attackers issue fraudulent HTTPS certificates. The Firefox team blocked them through OneCRL within hours of the October 17 report and released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 for users who missed the automatic update.
- Mozilla reported the compromise on Saturday, October 17, at 20:06 UTC and finished the OneCRL distribution by 22:59 UTC that day.
- Firefox 158.0.1 for Desktop and Android, ESR 115.43.1 and ESR 153.5.1 cover users whose custom settings may have blocked the automatic fix.
- NSS 3.131.1 removes the root certificate that signed the affected intermediates, helping other applications using Mozilla's trust store.
What changed
Mozilla says it was told that private keys tied to eight eMudhra intermediate certificates had been compromised. Such keys could let attackers issue fraudulent HTTPS certificates for sites they do not control, and an attacker able to intercept a connection could use them to impersonate websites and potentially read or modify traffic.
Mozilla engineers blocked the affected certificates in Firefox through OneCRL, its centralized revocation list, which the company says applies without a user update or restart. The distribution was complete for standard configurations by 22:59 UTC on October 17, under three hours after the report arrived at 20:06 UTC.
Who is affected
Most Firefox users with standard configurations received the OneCRL protection automatically. Mozilla released Firefox 158.0.1 for Desktop and Android, Firefox ESR 115.43.1 and Firefox ESR 153.5.1 for a minority of users whose custom settings may have prevented the OneCRL update.
Mozilla also updated the trusted certificate list in NSS to version 3.131.1, removing the root certificate that signed the affected intermediates. Firefox is already covered through OneCRL, but Mozilla says this step helps other applications that use its trust store, or versions derived from it, and do not receive OneCRL updates.
What is available
The OneCRL block and the listed Firefox updates are available now. Mozilla says it will share more information when circumstances allow. The company described security and privacy online as fundamental rights and said it acted quickly to protect users.
Do Firefox users need to update to get protection from the compromised eMudhra certificates?
Most users with standard configurations were protected automatically through OneCRL without updating or restarting. Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 exist for a minority whose custom settings may have blocked that automatic update.
Sources & further reading
- Protecting Firefox users following the compromise of eMudhra intermediate certificates – Mozilla Security Blog ↗blog.mozilla.org
Help keep the record accurate. Send a correction.
