Google Cloud SDK clients may trust compromised CA roots
Google says private keys tied to eight eMudhra subordinate certificate authority (CA) certificates were compromised; it received the report on October 17 and described it in a November 2 security bulletin. Google reports no breach of its cloud infrastructure and no evidence of exploitation against Google Cloud workloads.
A CA’s private key lets it vouch for other websites. Applications whose trust stores still accept emSign ECC Root CA - G3, emSign Root TLS CA - G3, or AAA Certificate Services may accept certificates under that compromised trust. Google Cloud SDK libraries generally don’t bundle CA roots: transport dependencies, language runtimes, or operating systems supply them, so updating the SDK alone can leave the trust unchanged.
Any application whose effective trust store accepts those roots has this exposure, even if it does not use Google Cloud SDK libraries. If the trust store is packaged in a container, stale trust can persist in deployed images until they are rebuilt and redeployed.
CVEs in this update
384 CVEs
Across VMware vCenter Server, VMware Cloud Foundation, VMware vCenter Server and VMware Cloud Foundation, sudo, and related packages.
22 critical · 183 high · 119 medium · 9 low
28 in CISA KEV · 133 with EPSS above 1%
26 with functional or packaged public exploit code