If you pin webpki-roots, check the version: 1.0.9 still trusts the eMudhra root Apple told everyone to delete

community
1

Context is the eMudhra / emSign CA compromise. Mozilla, Google, Microsoft and most distros dropped the roots over a week ago. Apple's macOS command line tools still trust them, which is what Hacker News is arguing about today.

If you build on rustls you probably get your trust anchors from webpki-roots, compiled into the binary. I checked ours this afternoon (Mars, a browser engine we're writing from scratch, pinned webpki-roots = "=1.0.9" from July in two crates). Grepping src/lib.rs in each version:

  • 1.0.9 (Jul 18): emSign Root CA - G1, emSign Root CA - C1, emSign ECC Root CA - G3, emSign ECC Root CA - C3
    • 1.0.10 (Oct 19): removed emSign ECC Root CA - G3
    • 1.0.11 (Oct 23): removed emSign Root CA - C1 and emSign ECC Root CA - C3, tracking the CCADB removals
      So an exact pin, or a Cargo.lock nobody has touched since summer, means the binary still trusts the root Apple's support note tells people to delete by hand. rustls does no revocation checking unless you hand it CRLs, and there is no blocklist, so nothing at runtime tells you.

Fix is cargo update -p webpki-roots and dropping any =1.0.9 pins. Ours is bumped and compiles. If you vendor roots another way, worth a grep for emSign.

Release notes: Releases · rustls/webpki-roots · GitHub

2

See also:

You need to update these crates to these versions:

  • rustls-webpki >= 0.103.16
  • webpki-roots >= 1.0.10
  • webpki-root-certs >= 1.0.10

There are already RUSTSEC advisories for these, which will show up when you use cargo-audit. You can also use it to check Rust programs compiled using cargo-auditable. The advisories are here: