BlockBeats reported that security researchers found a private-key generation flaw affecting eight intermediate certificates issued by Indian certificate authority eMudhra.
Reported risk
The report said the keys contained only very small effective values and could be fully cracked in under a second. It said access to an intermediate certificate key could allow forged trusted HTTPS certificates and man-in-the-middle attacks that intercept or alter communications. These technical claims are reported by BlockBeats; the flash provides no certificate serial numbers, fingerprints or vulnerability identifier.
Blocking and update claims
BlockBeats said Chrome, Firefox, Apple and Microsoft issued updates to block the eight certificates, while eMudhra revoked them. It also said Go, Python, Rust and Electron pushed ecosystem updates. The report said no evidence of malicious use had been found, but older systems and IoT devices may take longer to update.
Users should follow verified browser and operating-system security guidance. Read the original BlockBeats flash.