From 2791dd40694e11b899ecee01a30afdc8c0a63d08 Mon Sep 17 00:00:00 2001 From: David Larsen Date: Tue, 20 Oct 2026 21:50:37 -0400 Subject: [PATCH 1/6] fix(docker): drop CA roots behind the compromised eMudhra intermediates The private keys for eight eMudhra intermediate CAs leaked (disclosed 2026-10-20). Every TLS client in the 3.4.0 image still trusts certificates issued from them. Require ca-certificates 20250419+deb13u1 or newer. It removes emSign ECC Root CA - G3 and AAA Certificate Services, the two roots those intermediates chain to. The bundled Trivy and TruffleHog read the system store, so they reject the chains even on their current Go toolchains. Bump certifi to 2026.10.19, which drops the same emSign root for the requests calls to our API and GitHub. --- Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 967c5f9..2a1ea57 100644 --- a/Dockerfile +++ b/Dockerfile @@ -56,10 +56,13 @@ COPY --from=trufflehog /usr/bin/trufflehog /usr/local/bin/trufflehog COPY --from=opengrep-installer /root/.opengrep /root/.opengrep # System deps + Node.js 22.x + Socket CLI +# ca-certificates must be 20250419+deb13u1 or newer, which drops the roots the +# compromised eMudhra intermediates chain to. RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ - curl git wget ca-certificates + curl git wget ca-certificates \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs ARG SOCKET_NPM_CLI_VERSION From e125c67d3d6a76a8dd0d229666c1fb8364eb994b Mon Sep 17 00:00:00 2001 From: David Larsen Date: Tue, 20 Oct 2026 22:01:59 -0400 Subject: [PATCH 2/6] docs: add changelog entry for the eMudhra CA fix --- CHANGELOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c22a108..ce1fe89 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +### Fixed + +- **The image no longer trusts certificates issued from the compromised eMudhra + intermediate CAs.** The private keys for eight eMudhra intermediates leaked + (disclosed 2026-10-20). The build now requires `ca-certificates` + `20250419+deb13u1` or newer, which removes the emSign ECC Root CA - G3 and AAA + Certificate Services roots those intermediates chain to, and `certifi` moves + to 2026.10.19. The bundled Trivy and TruffleHog, `curl`, and Python `requests` + now reject those chains. Node's bundled CA store keeps trusting them until + Node ships its fix, and container scanners may still report CVE-2026-111943 + against the Trivy and TruffleHog binaries until they are rebuilt on Go 1.26.10 + or 1.27.3. + ## [3.4.0] - 2026-09-18 Findings for the hardcoded-credential rules now report where a credential is From 8e8229671dc3ed21a4a8bcf661aabbc600f0eef3 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Tue, 20 Oct 2026 22:22:34 -0400 Subject: [PATCH 3/6] fix(docker): extend the eMudhra CA fix to the heavy image and Node Apply the ca-certificates floor to Dockerfile.heavy, floor certifi on the heavy image's system interpreter (which runs the Python CLI outside the locked venv), and set NODE_OPTIONS=--use-openssl-ca in both images so Node and the Socket npm CLI use the patched system store until Node ships its fix. --- CHANGELOG.md | 21 ++++++++++++--------- Dockerfile | 4 ++++ Dockerfile.heavy | 13 +++++++++++-- 3 files changed, 27 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce1fe89..5ed183f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,16 +10,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Fixed -- **The image no longer trusts certificates issued from the compromised eMudhra +- **The images no longer trust certificates issued from the compromised eMudhra intermediate CAs.** The private keys for eight eMudhra intermediates leaked - (disclosed 2026-10-20). The build now requires `ca-certificates` - `20250419+deb13u1` or newer, which removes the emSign ECC Root CA - G3 and AAA - Certificate Services roots those intermediates chain to, and `certifi` moves - to 2026.10.19. The bundled Trivy and TruffleHog, `curl`, and Python `requests` - now reject those chains. Node's bundled CA store keeps trusting them until - Node ships its fix, and container scanners may still report CVE-2026-111943 - against the Trivy and TruffleHog binaries until they are rebuilt on Go 1.26.10 - or 1.27.3. + (disclosed 2026-10-20). Both the standard and heavy builds now require + `ca-certificates` `20250419+deb13u1` or newer, which removes the emSign ECC + Root CA - G3 and AAA Certificate Services roots those intermediates chain to, + and `certifi` moves to 2026.10.19 (the heavy image's system interpreter, which + runs the Python CLI, gets a `certifi>=2026.10.19` floor). The bundled Trivy and + TruffleHog, `curl`, `git`, and Python `requests` now reject those chains. + Node's bundled CA store still trusts them and Node hasn't shipped a fix, so + the images set `NODE_OPTIONS=--use-openssl-ca` to point Node (and the Socket + npm CLI) at the patched system store until it does. Container scanners may + still report CVE-2026-111943 against the Trivy and TruffleHog binaries until + they are rebuilt on Go 1.26.10 or 1.27.3. ## [3.4.0] - 2026-09-18 diff --git a/Dockerfile b/Dockerfile index 2a1ea57..c49a1f1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -65,6 +65,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs +# Node's bundled CA store still trusts the compromised eMudhra intermediates and +# no patched Node release exists yet. Use the system store, which ca-certificates +# above already fixed. Drop this once Node ships its fix. +ENV NODE_OPTIONS="--use-openssl-ca" ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" diff --git a/Dockerfile.heavy b/Dockerfile.heavy index 26af639..5035a81 100644 --- a/Dockerfile.heavy +++ b/Dockerfile.heavy @@ -30,12 +30,19 @@ COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy COPY --from=trufflehog /usr/bin/trufflehog /usr/local/bin/trufflehog COPY --from=opengrep-installer /root/.opengrep /root/.opengrep +# ca-certificates must be 20250419+deb13u1 or newer, which drops the roots the +# compromised eMudhra intermediates chain to. RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ - curl git wget ca-certificates + curl git wget ca-certificates \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs +# Node's bundled CA store still trusts the compromised eMudhra intermediates and +# no patched Node release exists yet. Use the system store, which ca-certificates +# above already fixed. Drop this once Node ships its fix. +ENV NODE_OPTIONS="--use-openssl-ca" ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" @@ -45,10 +52,12 @@ COPY pyproject.toml README.md LICENSE uv.lock /socket-basics/ ENV UV_LINK_MODE=copy ARG SOCKET_PYTHON_CLI_VERSION +# The Python CLI runs on the system interpreter, not the locked venv, so floor +# certifi there too (2026.10.19 drops the compromised eMudhra roots). RUN --mount=type=cache,target=/root/.cache/uv \ pip install -e . \ && uv sync --frozen --no-dev \ - && pip install --no-cache-dir "socketsecurity==${SOCKET_PYTHON_CLI_VERSION}" + && pip install --no-cache-dir "socketsecurity==${SOCKET_PYTHON_CLI_VERSION}" "certifi>=2026.10.19" COPY scripts/docker-heavy-entrypoint.sh /usr/local/bin/docker-heavy-entrypoint.sh RUN chmod +x /usr/local/bin/docker-heavy-entrypoint.sh From 311bc4e3571c0d29f79f2c1707452804ec49e1b0 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:37:00 -0400 Subject: [PATCH 4/6] fix(docker): require Node 22.23.4 instead of pointing Node at the system store Node 22.23.4 rejects the compromised eMudhra intermediates itself, and NodeSource's setup_22.x already serves it. Fail the build on an older Node and drop NODE_OPTIONS=--use-openssl-ca, which a caller's own NODE_OPTIONS would have overridden. --- CHANGELOG.md | 5 ++--- Dockerfile | 8 +++----- Dockerfile.heavy | 8 +++----- 3 files changed, 8 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5ed183f..8521ece 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,9 +18,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). and `certifi` moves to 2026.10.19 (the heavy image's system interpreter, which runs the Python CLI, gets a `certifi>=2026.10.19` floor). The bundled Trivy and TruffleHog, `curl`, `git`, and Python `requests` now reject those chains. - Node's bundled CA store still trusts them and Node hasn't shipped a fix, so - the images set `NODE_OPTIONS=--use-openssl-ca` to point Node (and the Socket - npm CLI) at the patched system store until it does. Container scanners may + The images also require Node 22.23.4 or newer, which rejects them for Node + and the Socket npm CLI. Container scanners may still report CVE-2026-111943 against the Trivy and TruffleHog binaries until they are rebuilt on Go 1.26.10 or 1.27.3. diff --git a/Dockerfile b/Dockerfile index c49a1f1..1103697 100644 --- a/Dockerfile +++ b/Dockerfile @@ -63,12 +63,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ curl git wget ca-certificates \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 +# Node rejects the compromised eMudhra intermediates from 22.23.4. RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ - && apt-get install -y nodejs -# Node's bundled CA store still trusts the compromised eMudhra intermediates and -# no patched Node release exists yet. Use the system store, which ca-certificates -# above already fixed. Drop this once Node ships its fix. -ENV NODE_OPTIONS="--use-openssl-ca" + && apt-get install -y nodejs \ + && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)' ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" diff --git a/Dockerfile.heavy b/Dockerfile.heavy index 5035a81..6bbd30e 100644 --- a/Dockerfile.heavy +++ b/Dockerfile.heavy @@ -37,12 +37,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ curl git wget ca-certificates \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 +# Node rejects the compromised eMudhra intermediates from 22.23.4. RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ - && apt-get install -y nodejs -# Node's bundled CA store still trusts the compromised eMudhra intermediates and -# no patched Node release exists yet. Use the system store, which ca-certificates -# above already fixed. Drop this once Node ships its fix. -ENV NODE_OPTIONS="--use-openssl-ca" + && apt-get install -y nodejs \ + && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)' ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" From 3a17a0d473027798c04df33954436d2759eb4ac5 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:23:59 -0400 Subject: [PATCH 5/6] fix(docker): upgrade pip and floor certifi for source installs pip checks certificates against its own vendored CA bundle, and the base image's pip 25.0.1 (certifi 2024.08.30) accepted both eMudhra test hosts. Upgrade it to 26.2.2 or newer against the fixed system store in both images. certifi only came in through requests, so a source install (pip install -e .) could keep an old bundle. Require certifi>=2026.10.19. Relocked with uv 0.12.1, the version the images use. --- CHANGELOG.md | 4 +++- Dockerfile | 5 +++++ Dockerfile.heavy | 5 +++++ pyproject.toml | 5 ++++- uv.lock | 2 ++ 5 files changed, 19 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8521ece..8a41541 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,7 +19,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). runs the Python CLI, gets a `certifi>=2026.10.19` floor). The bundled Trivy and TruffleHog, `curl`, `git`, and Python `requests` now reject those chains. The images also require Node 22.23.4 or newer, which rejects them for Node - and the Socket npm CLI. Container scanners may + and the Socket npm CLI, and pip 26.2.2 or newer, whose vendored CA bundle + rejects them too. Source installs (`pip install -e .`) now require + `certifi>=2026.10.19`. Container scanners may still report CVE-2026-111943 against the Trivy and TruffleHog binaries until they are rebuilt on Go 1.26.10 or 1.27.3. diff --git a/Dockerfile b/Dockerfile index 1103697..19d2eb6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -63,6 +63,11 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ curl git wget ca-certificates \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 +# pip checks certificates against its own vendored CA bundle, not the system +# store, and the base image's pip trusts the compromised intermediates. 26.2.2 +# vendors certifi 2026.10.19. Upgrade it against the system store fixed above. +RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \ + && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))' # Node rejects the compromised eMudhra intermediates from 22.23.4. RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs \ diff --git a/Dockerfile.heavy b/Dockerfile.heavy index 6bbd30e..64a839c 100644 --- a/Dockerfile.heavy +++ b/Dockerfile.heavy @@ -37,6 +37,11 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ apt-get update && apt-get install -y --no-install-recommends \ curl git wget ca-certificates \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 +# pip checks certificates against its own vendored CA bundle, not the system +# store, and the base image's pip trusts the compromised intermediates. 26.2.2 +# vendors certifi 2026.10.19. Upgrade it against the system store fixed above. +RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \ + && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))' # Node rejects the compromised eMudhra intermediates from 22.23.4. RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs \ diff --git a/pyproject.toml b/pyproject.toml index 9a6f9b7..45e63a0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -29,7 +29,10 @@ dependencies = [ "PyYAML>=6.0.0", "tomli; python_version < '3.11'", "socketdev>=3.5.0", - "jsonschema>=4.25.1" + "jsonschema>=4.25.1", + # requests' CA bundle; 2026.10.19 drops the roots behind the compromised + # eMudhra intermediates. Covers source installs (`pip install -e .`). + "certifi>=2026.10.19" ] [project.optional-dependencies] diff --git a/uv.lock b/uv.lock index a56300b..a9b5905 100644 --- a/uv.lock +++ b/uv.lock @@ -695,6 +695,7 @@ name = "socket-basics" version = "3.4.0" source = { editable = "." } dependencies = [ + { name = "certifi" }, { name = "jsonschema" }, { name = "light-s3-client" }, { name = "pyyaml" }, @@ -715,6 +716,7 @@ dev = [ [package.metadata] requires-dist = [ { name = "black", marker = "extra == 'dev'", specifier = ">=26.5.1" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "flake8", marker = "extra == 'dev'", specifier = ">=5.0.0" }, { name = "jsonschema", specifier = ">=4.25.1" }, { name = "light-s3-client", specifier = "~=0.0.30" }, From 96af182d448523343fcac5b7e40afaaa08d30854 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:45:57 -0400 Subject: [PATCH 6/6] docs(changelog): tighten the eMudhra entry --- CHANGELOG.md | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8a41541..a671653 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,20 +10,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Fixed -- **The images no longer trust certificates issued from the compromised eMudhra - intermediate CAs.** The private keys for eight eMudhra intermediates leaked - (disclosed 2026-10-20). Both the standard and heavy builds now require - `ca-certificates` `20250419+deb13u1` or newer, which removes the emSign ECC - Root CA - G3 and AAA Certificate Services roots those intermediates chain to, - and `certifi` moves to 2026.10.19 (the heavy image's system interpreter, which - runs the Python CLI, gets a `certifi>=2026.10.19` floor). The bundled Trivy and - TruffleHog, `curl`, `git`, and Python `requests` now reject those chains. - The images also require Node 22.23.4 or newer, which rejects them for Node - and the Socket npm CLI, and pip 26.2.2 or newer, whose vendored CA bundle - rejects them too. Source installs (`pip install -e .`) now require - `certifi>=2026.10.19`. Container scanners may - still report CVE-2026-111943 against the Trivy and TruffleHog binaries until - they are rebuilt on Go 1.26.10 or 1.27.3. +- **The images no longer trust certificates from the compromised eMudhra + intermediate CAs** (keys disclosed 2026-10-20). Both images now require + `ca-certificates` `20250419+deb13u1`, Node 22.23.4, pip 26.2.2 and `certifi` + 2026.10.19 or newer, and source installs (`pip install -e .`) require the same + `certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and + TruffleHog now reject those chains. Container scanners may still report + CVE-2026-111943 against the Trivy and TruffleHog binaries until they are + rebuilt on Go 1.26.10 or 1.27.3. ## [3.4.0] - 2026-09-18