tag: Certificate-Authority · 3 items
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Removes trust for compromised eMudhra CA private keys from Envoy’s trust store; any 1.37.x deployment trusting those CAs is exposed to fraudulent cert acceptance. No KEV listing or confirmed active exploitation, so cap is Plan — schedule patching to 1.37.10 this sprint; 1.37 itself EOLs 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 reaches EOL in 79d (2027-01-13)