Skip to content

fix(deps): distrust the compromised eMudhra CAs (0.8.1) #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
christianhuening merged 1 commit into from
Oct 21, 2026
Merged

fix(deps): distrust the compromised eMudhra CAs (0.8.1) #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 34 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,38 @@ so this log can be regenerated from history (e.g. with `git-cliff`).

## [Unreleased]

## [0.8.1] - 2026-10-21

### Upgrading
- knot no longer trusts the `emSign ECC Root CA - G3` root certificate. If your
OIDC provider, S3 endpoint or Postgres server presents a certificate that
chains to it, knot can no longer connect to it. Chrome is removing the same
root. (#43)

### Security
- **eMudhra CA key compromise** (RUSTSEC-2026-0381, RUSTSEC-2026-0382). The
private keys of eight eMudhra intermediate CAs can be recovered from their
public certificates, so anyone can issue a certificate for any hostname that
knot accepted. This affected knot's connections to the OIDC provider, the S3
blob backend and Postgres. An attacker in the network path to the OIDC
provider could substitute their own signing keys when knot starts and then
sign in as any user, or capture the client secret and users' authorization
codes at login. knot's trusted roots are compiled into the binary and it
checks neither revocation nor Certificate Transparency, so eMudhra's
revocation and the browser blocks did not protect it, and there is no CA
bundle to update: upgrading is the only fix. `rustls-webpki` 0.103.16
rejects chains through the eight intermediates and `webpki-roots` 1.0.10
drops the root. The Postgres change-notification connection was not
affected: it trusts only `sslrootcert`. (#43)
- `rustls` 0.23.46 fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347,
RUSTSEC-2026-0348 and RUSTSEC-2026-0349. (#43)
- `ammonia` 4.1.8 fixes RUSTSEC-2026-0373. knot was not affected: its
sanitizer does not allow `style` attributes. (#43)
- RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 (`zip`
extraction) are acknowledged in `deny.toml`. knot was not affected: it reads
import archives in memory and never extracts them to disk. The fix needs
zip 9. (#43)

## [0.8.0] - 2026-10-13

### Upgrading
Expand Down Expand Up @@ -559,7 +591,8 @@ First tagged release. Feature-complete for single-workspace teams.
- Helm chart with migrate hook, NetworkPolicy, ServiceMonitor, PrometheusRule,
and multi-arch (amd64 + arm64) scratch image.

[Unreleased]: https://github.com/opendefensecloud/knot/compare/v0.8.0...HEAD
[Unreleased]: https://github.com/opendefensecloud/knot/compare/v0.8.1...HEAD
[0.8.1]: https://github.com/opendefensecloud/knot/compare/v0.8.0...v0.8.1
[0.8.0]: https://github.com/opendefensecloud/knot/compare/v0.7.0...v0.8.0
[0.7.0]: https://github.com/opendefensecloud/knot/compare/v0.6.0...v0.7.0
[0.6.0]: https://github.com/opendefensecloud/knot/compare/v0.5.0...v0.6.0
Expand Down
16 changes: 8 additions & 8 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 14 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,20 @@ ignore = [
# Drop when: figment moves its Yaml provider off serde_yaml, or knot drops
# YAML config files.
{ id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml unmaintained; via figment's Yaml provider (serde_yaml); parses only the operator's KNOT_CONFIG file; no vulnerability" },

# zip < 9 extracts archives unsafely: ZipArchive::extract and
# ZipStreamReader::extract keep SUID/SGID bits, create symlinks whose
# targets lie outside the destination, and apply permissions through them.
# zip is a DIRECT dependency of knot-server (workspace export/import),
# pinned at ^8; the fixes exist only in the 9.0 major, which Renovate raises
# from the Dependency Dashboard rather than on its own.
# Reachability: none. Import opens the upload with ZipArchive::new over an
# in-memory buffer and reads entries by name; export only writes through
# ZipWriter. Nothing calls extract() or writes to the filesystem.
# Drop when: knot-server moves to zip >= 9.
{ id = "RUSTSEC-2026-0367", reason = "zip extract() keeps SUID/SGID bits; fix only in zip 9; knot reads archives in memory and never extracts" },
{ id = "RUSTSEC-2026-0368", reason = "zip extract() symlinks escape the destination; fix only in zip 9; knot reads archives in memory and never extracts" },
{ id = "RUSTSEC-2026-0369", reason = "zip extract() chmods through symlinks; fix only in zip 9; knot reads archives in memory and never extracts" },
]

[licenses]
Expand Down
Loading