Ethereum Clients Patch Certificate Flaw That Could Divert ETH Rewards
Teku, software many validators use to run Ethereum proof-of-stake, released version 26.10.3 on Tuesday. Besu, which processes Ethereum transactions, released version 26.10.2 on Monday. Both updates stop their Docker images from trusting certificates tied to eMudhra, an Indian certificate authority. Docker images are prepackaged versions that many operators run. Validators stake ETH to secure Ethereum and earn fees for proposing blocks. Some connect to other services over the internet and rely on digital certificates to confirm they are talking to the right service. On Oct. 17, researchers found that eight of eMudhra intermediate certificate authorities had private keys generated with too little randomness. Because the certificates are public, the weak keys could be derived from them. Anyone with those keys could issue certificates that unpatched software would accept as real. Browsers blocked the certificates, eMudhra revoked them a day later, and the company has said it will exit the certificate business. Java, the programming language Teku and Besu run on, does not check certificate revocation by default. Teku Docker images therefore kept trusting the bad certificates after browsers had dropped them. An attacker positioned between a validator and a service it connects to could impersonate that service. Teku said a validator fooled this way could propose a block that pays fees to the attacker address. A fake external signer, the separate service that holds validator keys, could hand over signatures used to change where rewards go. Teku ranked that as the riskiest setup. A default Teku node on mainnet is not affected and needs no action, the team said. No exploitation has been reported. Consensys Diligence, the Teku security partner, initially flagged the problem. Operators running Teku or Besu directly on machines without Docker must update Java themselves, because updating the Ethereum software does not change the Java list of trusted certificates. New Docker images also do not fix Java installed on the host. Java 26 is end of life and will not get a patched build, so operators still on that version need to move to Java 25.
