Envoy v1.37.10 addresses eMudhra CA compromise
Key Takeaway
Envoy has released a security update to revoke trust in compromised eMudhra intermediate CA certificates.
Summary
Envoy version 1.37.10 provides critical security fixes following the compromise of several eMudhra intermediate CA private keys. The update modifies Docker images to stop trusting the affected CAs and updates the Envoy Mobile root certificate bundle to remove specific compromised roots.
Security changes in v1.37.10
- Docker images: Updated to no longer trust compromised eMudhra intermediate CAs.
- Envoy Mobile: Removed AAA Certificate Services and emSign ECC Root CA - G3 roots from the built-in root certificate bundle.
- Impact: Servers relying solely on these specific roots for certificate chains will no longer be trusted by Envoy Mobile.
Why it matters
This update protects users from potential man-in-the-middle attacks resulting from the compromised eMudhra certificates.
Original reference: github.com →