Go’s latest releases, 1.27.3 and 1.26.10, introduce a security-focused update by blocking specific certificate authority (CA) keys due to security concerns. The Go team hasn’t named the CA but insists on an immediate upgrade, emphasizing the seriousness of the issue.
The blocked keys are tied to eMudhra, an Indian CA, with six associated with its emSign Root TLS CA – G3 and two linked to code-signing intermediates. Similarly, Mozilla recently blocked related certificates without disclosing specific reasons. The community linked these actions to eMudhra intermediates via certificate hashes.
Go’s update means programs will reject certificates from the problematic keys in both macOS and Windows environments, signifying there’s no opting out. As of now, the root of the problem at the CA level remains undisclosed, with Go defining this as an URGENT issue—a threat potentially compromising the ecosystem or reflecting active exploitation.
For sites using affected certificates, the only solution is issuing new ones through different intermediates. All this unfolds as Go bids farewell to version 1.25 and earlier, now unsupported and unfixed.
Read more at The Hacker News…