Repository navigation
fix(transport): Reject leaked eMudhra intermediate certificates - #6336
runningcode wants to merge 3 commits into
Conversation
🚨 Detected changes in high risk code 🚨High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:
|
1 similar comment
🚨 Detected changes in high risk code 🚨High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:
|
📲 Install BuildsAndroid
|
9099fca to
c17d99a
Compare
🚨 Detected changes in high risk code 🚨High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:
|
c17d99a to
fdafbb8
Compare
🚨 Detected changes in high risk code 🚨High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:
|
| } | ||
|
|
||
| connection.connect() | ||
| DistrustedCertificates.getInstance().verify(connection) |
There was a problem hiding this comment.
right now this is called statically, but we could also put it in SentryOptions and grab it from there but I wanted to avoid making a larger change since this is just for DistributionHttpClient.
| requestDetails, | ||
| AuthenticatorWrapper.getInstance(), | ||
| rateLimiter, | ||
| DistrustedCertificates.getInstance()); |
There was a problem hiding this comment.
here as an alternative design i inject the DistrustedCertificates instance making this easier to test/replace.
The private keys of eight eMudhra intermediates can be recovered from their certificates (CVE-2026-111943). Their Sectigo cross-signs chain to AAA Certificate Services, which is trusted on every Android version, so platform trust store updates won't reach every device. The envelope transport and the distribution client now reject servers that present one of these keys, right after the TLS handshake and before any request is written. Fixes JAVA-783 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inject the check through HttpConnection's constructor like AuthenticatorWrapper, so its tests can stub it instead of loading the real eMudhra certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fdafbb8 to
099ea84
Compare
🚨 Detected changes in high risk code 🚨High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:
|
📜 Description
Rejects TLS servers that present one of the eight leaked eMudhra intermediate certificates (CVE-2026-111943) in the two places where the SDK opens its own HTTPS connections: the envelope transport (
HttpConnection) and the distribution update check (DistributionHttpClient).How does it work:
The new internal
DistrustedCertificatesruns right afterconnect(), once the TLS handshake is done but before any of the request is written. It compares the SHA-256 of each server certificate's public key against the leaked keys, which matches both the eMudhra-issued certificates and their AAA Certificate Services cross-signs. On a match it disconnects and throwsSSLPeerUnverifiedException. Since that is anIOException, a blocked envelope is kept in the offline cache and retried later.💡 Motivation and Context
https://emudhra.we-have-a-problem.com/
Fixes JAVA-783
💚 How did you test it?
DistrustedCertificatesTestchecks the matching against the realEM DV TLS CA - G3Bcross-signed certificate.HttpConnectionTestmocks the check and verifies it runs afterconnect()and that a rejected connection never writes the envelope.DistributionHttpClientcreates its own connection, so it isn't covered by a dedicated test.📝 Checklist
sendDefaultPIIis enabled.🔮 Next steps
Out of scope:
SpotlightIntegrationonly talks to a local server, and the HTTP client integrations (sentry-okhttp, Apache, OpenFeign, Ktor, Spring) instrument the app's own clients, which the app has to fix itself.🤖 Generated with Claude Code