Apple was notified of the eMudhra incident on 17th October, yet as of 28th October the developer tools it ships with macOS, including git, curl and python3, still trust the compromised certificates. macOS 27.2, released on 26th October, did not fix the issue and undid the workaround users had applied by hand, leaving them vulnerable again. Meanwhile, dozens of other projects, many run by volunteers, shipped fixes days ago.
The risk is serious. Anyone able to intercept an HTTPS connection made by these tools can deliver attacker-chosen code through git clones and pulls from https:// remotes, alter pushes in transit, and capture credentials such as GitHub tokens. Anyone on the network path between a developer and GitHub can redirect that traffic without any special setup. To check whether git is affected, users can run git ls-remote against a test address: a certificate error means git is protected, while a listed commit means it is affected.
Apple has already protected Safari and other apps built on its networking framework. The site's author argues Apple should ship a fix for macOS developers as soon as possible, for example by removing the affected roots from /etc/ssl/cert.pem. Until then, developers can remove the affected roots by hand, but Apple's guidance warns that macOS updates may revert the fix, so checks and the workaround must be repeated after every update.
Security teams are advised to review whether macOS runners are used in their CI or other build infrastructure and to assess the resulting supply chain risk.
Source: Hacker News · Summarized by HeadlinesBriefing