Ethereum node clients Teku and Besu have released Docker security fixes; binary users need to check their Java runtime environment separately

TechFlow news, October 29: According to CryptoSlate, Ethereum node clients Teku and Besu have released Docker security fixes in response to the eMudhra certificate authority (CA) breach. Teku 26.10.3 (released October 27) and Besu 26.10.2 (released October 26) removed four root certificates—emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services—from the trust stores of their Docker images.

The incident involves the private keys of eight emSign G3 intermediate CAs under eMudhra being recoverable. eMudhra acknowledged that a scripting error generated weak keys, and the affected intermediate certificates were revoked after a report was received on October 17. However, Teku's security advisory noted that Java does not check certificate revocation status by default, so affected runtimes still require separate remediation.

Operators using binary installations (Teku binary distribution packages, Besu tar/zip) rely on independently installed Java and need to check and remediate it separately. Updating Java only on the host does not change the runtime inside the container.

Teku said no exploitation of the related vulnerability has been observed. Default mainnet nodes without configured HTTPS URLs are unaffected, and their libp2p and discv5 peer-to-peer networks are not affected by this issue. The risk mainly lies in HTTPS connections to remote signers, beacon nodes, execution clients, builders, or relays: if an attacker intercepts connections on an unpatched runtime, they may impersonate a remote beacon node, causing proposal fees to be redirected or validator duties to be missed. If they impersonate an external signer, they may obtain validator exit signatures.

Source: TechFlow