macOS 27.2 CLI Tools Still Trust Revoked eMudhra Certificates
Built-in macOS 27.2 CLI tools like Git and curl bypass Apple's blocklist, still trusting revoked eMudhra certificates. On intercepted networks, attackers could spoof sites to alter code. Apple plans a fix in a future update.
Apple released macOS 27.2 on October 26, but researchers found tools like Git, curl, and Python 3 use /etc/ssl/cert.pem and bypass Apple's blocklist, still trusting revoked eMudhra intermediate CA certificates. If traffic is intercepted, attackers could spoof sites like GitHub to tamper with code. Apple confirmed CLI protections are incomplete and will be fixed in an upcoming update, noting OS updates may overwrite manual CA changes.
Key takeaways
- macOS CLI tools rely on /etc/ssl/cert.pem without checking blocklists, leaving them open to revoked eMudhra certificates.
- Apple confirmed CLI protections are incomplete, planned an update, and warned OS upgrades may overwrite manual CA removals.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.