Choose Rich Live
Crypto News

Teku and Besu issue updates after eMudhra certificate compromise

Ethereum clients Teku and Besu released updated Docker distributions to remove four certificate roots following a security breach at Indian certificate authority eMudhra, while node operators running binary installations must verify their Java runtime independently.

Developers behind Ethereum clients Teku and Besu have pushed security updates following a compromise at Indian certificate authority eMudhra that left some setups trusting forged certificates. The updated Docker distributions, Teku 26.10.3 and Besu 26.10.2, remove four certificate roots to resolve the issue with certificate trust handling.[3][4][1]

While the Docker images contain the patch directly, operators running standalone binary versions of Teku and Besu must separately inspect and update their locally installed Java runtime environments to clear the affected roots, according to CryptoSlate. CoinDesk reported that default Ethereum mainnet node setups were not exposed to the vulnerability, and Teku reported no known exploitation.[1][4][3]

Reporting on the client patches, including from Crypto Briefing, highlighted that the broader vulnerability fix aimed to prevent potential attacks involving the redirection of ETH rewards.[2][3]

Key facts

  • Teku 26.10.3 and Besu 26.10.2 Docker releases remove four certificate roots following a certificate-authority compromise at eMudhra.
  • The eMudhra security failure left certain Teku and Besu configurations trusting forged certificates, though default mainnet nodes were not exposed.
  • Operators utilizing binary distributions of Teku and Besu must separately check their local Java runtime for the affected roots.
  • Teku reported no exploitation of the flaw.
  • Ethereum client developers patched the vulnerability to prevent the redirection of ETH rewards.

Sources · 4 sources

  1. CR

    CryptoSlateArticle ·

    Ethereum client security fixes leave binary users with a separate Java check Teku and Besu Docker releases fix certificate trust, while binary users need to check their separately installed Java runtime. Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox

    Open source
  2. CB

    Crypto BriefingArticle ·

    Ethereum clients patch vulnerability to prevent ETH reward redirection The swift patching of Ethereum's vulnerability underscores the importance of robust governance and proactive security in blockchain upgrades. The post Ethereum clients patch vulnerability to prevent ETH reward redirection appeared first on Crypto Briefing .

    Open source
  3. CO

    CoindeskArticle ·

    Security failure at Indian certificate firm bites Ethereum as developers rush out fixes A key blunder at Indian certificate issuer eMudhra left some Teku and Besu setups trusting forged certificates. Default mainnet nodes weren’t exposed.

    Open source
  4. CR

    CryptoSlate@CryptoSlatePost on X ·

    Ethereum clients Teku 26.10.3 and Besu 26.10.2 drop four certificate roots from Docker images after a certificate-authority compromise at eMudhra. Binary installs need their Java runtime checked separately. Teku reports no exploitation. via @akibablade https://t.co/Ousd9JxB4O

    Open source