Java updates stop trusting eMudhra’s compromised certificate authorities
- Affected
- Oracle Java SE and GraalVM versions Oracle supports, standalone OpenJDK runtimes before the Oct 21 fixes, and Node.js before
22.23.4,24.22.1and26.12.1. All versions and fixes
- CVE
- Vendors
- Oracle, eMudhra
Oracle and the OpenJDK project fixed Java on Oct 21 so that it stops trusting the eight eMudhra certificate authorities whose private keys anyone can recover. Oracle tracks the flaw as , rates it 9.1 under CVSS 3.1 and has patches for Java SE and GraalVM. Node.js 22.23.4, 24.22.1 and 26.12.1, out the same day, also update the root certificates they bundle. Oracle’s alert doesn’t say whether anyone has used the keys against Java.
Mozilla says the compromised keys could let attackers issue fraudulent certificates for websites they don’t control. An attacker who can intercept a connection could then impersonate a website and read or change its traffic. OpenJDK says a standalone Java runtime likely contains the compromised certificates, and Oracle says the flaw can be exploited over a network without authentication.
Oracle’s Security Alert covers Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20. It links a patch availability document for each product. Oracle doesn’t test releases outside its Premier or Extended Support for the flaw, but says earlier versions are likely affected too.
For runtimes that can’t be updated at once, OpenJDK and Oracle give two stopgaps: a new blocked.certs file that blocks the eight certificates, or turning on revocation checking. Oracle says Java applications that already check revocation are likely protected. OpenJDK says the Java packages of most Linux distributions, including Debian, Fedora, Red Hat Enterprise Linux and Ubuntu, use the system’s certificates, so updating those is enough.
The Node.js releases move the root certificates Node.js bundles to those in Mozilla’s Network Security Services (NSS) 3.131.1. Mozilla says that NSS update removes the root certificate that signed the compromised intermediates, to protect applications that use its trust store but don’t get its revocation updates.
- CVE
- Vendors
- Oracle, eMudhra
What to do
8 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Oracle Java SE | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 | Oracle’s Oct 21 Security Alert patches |
| Oracle GraalVM for JDK | 17.0.21 and 21.0.13 | Oracle’s Oct 21 Security Alert patches |
| Oracle GraalVM Enterprise Edition | 21.3.20 | Oracle’s Oct 21 Security Alert patches |
| OpenJDK, standalone runtimes | 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512 and earlier | Each provider’s update, or OpenJDK’s new blocked.certs file until then |
| OpenJDK packages from Arch Linux, Debian, Devuan, Fedora, Gentoo, Oracle Linux, Red Hat Enterprise Linux and Ubuntu | Use the operating system’s certificates | The distribution’s certificate update |
| OpenJDK packages from FreeBSD and Homebrew | Packages without the fix | The updated package |
| Node.js 22 | Before 22.23.4 | 22.23.4 |
| Node.js 24 | Before 24.22.1 | 24.22.1 |
| Node.js 26 | Before 26.12.1 | 26.12.1 |
- Product
- Oracle Java SE
- Affected
8u511,8u511-perf,11.0.33,17.0.21,21.0.13,25.0.5and27.0.1- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- Oracle GraalVM for JDK
- Affected
17.0.21and21.0.13- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- Oracle GraalVM Enterprise Edition
- Affected
21.3.20- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- OpenJDK, standalone runtimes
- Affected
27.0.1,25.0.5,21.0.13,17.0.21,11.0.33,8u512and earlier- Fixed
- Each provider’s update, or OpenJDK’s new
blocked.certsfile until then
- Product
- OpenJDK packages from Arch Linux, Debian, Devuan, Fedora, Gentoo, Oracle Linux, Red Hat Enterprise Linux and Ubuntu
- Affected
- Use the operating system’s certificates
- Fixed
- The distribution’s certificate update
- Product
- OpenJDK packages from FreeBSD and Homebrew
- Affected
- Packages without the fix
- Fixed
- The updated package
- Product
- Node.js 22
- Affected
- Before
22.23.4 - Fixed
22.23.4
- Product
- Node.js 24
- Affected
- Before
24.22.1 - Fixed
24.22.1
- Product
- Node.js 26
- Affected
- Before
26.12.1 - Fixed
26.12.1
Sources
- Oracle advisoryPrimary source oracle.com
- OpenJDK advisoryPrimary source openjdk.org
- Node.js advisoryPrimary source nodejs.org
- Oracle noticePrimary source ops.java
- Node.js release notesPrimary source nodejs.org
- Mozilla noticePrimary source blog.mozilla.org