Security Flaws Hit Ethereum Teku and Besu Clients

Teku and Besu clients, used to operate Ethereum network nodes, have released security patches following an incident involving the eMudhra certificate authority. Versions Teku 26.10.3 and Besu 26.10.2 remove trust in four specific certificate roots. The measure aims to mitigate risks stemming from weak private keys generated by a scripting error at the certification entity.

Updates to the client Docker images already incorporate the removal of these certificates. Operators using these images must update their containers to ensure protection. The original issue involved the issuance of intermediate certificates with recoverable keys, which led to the revocation of these credentials in mid-October.

Users opting for binary installations face an additional challenge. Since Java does not check for certificate revocation by default, updating the client software does not automatically change the runtime environment installed on the machine. It is necessary to perform a manual check on the Java runtime to ensure that the compromised roots are no longer accepted.

The security advisory notes that mainnet nodes without HTTPS URLs configured have lower exposure. However, HTTPS connections can be intercepted by malicious actors in unpatched environments. So far, there are no reports of active exploitation of these vulnerabilities on Ethereum network nodes.

Configurations that rely on HTTPS, such as validators, beacon nodes, and metrics services, require extra attention. The same applies to testnets that download initial states via HTTPS during startup. Responsibility for the integrity of the runtime environment remains with the node operator.