Skip to content

Response to eMudhra CA certificates compromise #7428

Open
Bug
Open
Response to eMudhra CA certificates compromise#7428
Bug
Assignees
lbussell
Labels
area-dockerfilesConcerns the official .NET Dockerfiles or Dockerfile templatesvulnerabilityReport of a known vulnerability in an image

Description

@ajuch
ajuch
opened on Oct 22, 2026

Hi,

Several CA intermediate certificates have been compromised and were quickly blocked by browsers (details: https://emudhra.we-have-a-problem.com/). The official dotnet docker images (at least 10.0-azurelinux3) still ship these certificates:

# docker run --rm -it mcr.microsoft.com/dotnet/aspnet:10.0-azurelinux3.0
root [ / ]# curl https://dv-g3b-emudhra.we-have-a-problem.com/
Your client successfully connected to the site. That's bad!
root [ / ]#

It would be great if new versions without these certificates would be released.

Br, Andreas

Activity

  1. github-project-automation
    added this to .NET Dockeron Oct 22, 2026
  2. github-project-automation
    moved this to Backlog in .NET Dockeron Oct 22, 2026
  3. github-actions
    added
    untriaged
    on Oct 22, 2026

  4. lbussell commented on Oct 22, 2026

    @lbussell
    lbussell
    on Oct 22, 2026
    Member

    Hi @ajuch,

    Here's the status for the various .NET container image platforms:

    • Debian (all versions) - ✅ Patched
    • Ubuntu (all versions) - ✅ Patched
    • Alpine (3.24) - ✅ Patched
    • Azure Linux (all versions) - 🕑 Will be updated later this morning
      • Includes Aspire Dashboard, .NET Monitor, and YARP images

    I'll update this issue when all images are fully patched.

  5. lbussell
    added
    area-dockerfilesConcerns the official .NET Dockerfiles or Dockerfile templates
    vulnerabilityReport of a known vulnerability in an image
    and removed
    untriaged
    on Oct 22, 2026
  6. lbussell
    self-assigned this
    on Oct 22, 2026
  7. lbussell
    added the
    Bug
    issue type on Oct 22, 2026
  8. lbussell
    moved this from Backlog to Rollout in .NET Dockeron Oct 22, 2026
  9. lbussell
    pinned this issue on Oct 22, 2026
  10. lbussell
    changed the title [-]Blocked CA certificates still contained at least in 10.0-azurelinux3 images[/-] [+]Response to eMudhra CA certificates compromise[/+] on Oct 22, 2026

  11. lbussell commented on Oct 22, 2026

    @lbussell
    lbussell
    on Oct 22, 2026
    Member

    Azure Linux 3 images have been updated:

    > docker run --rm mcr.microsoft.com/dotnet/aspnet:10.0-azurelinux3.0 curl https://dv-g3b-emudhra.we-have-a-problem.com/

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
curl: (60) SSL certificate problem: certificate rejected
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

    Azure Linux 4 images are still pending.

  12. ajuch commented on Oct 23, 2026

    @ajuch
    ajuch
    on Oct 23, 2026
    Author

    Thanks for the quick response!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area-dockerfilesConcerns the official .NET Dockerfiles or Dockerfile templatesvulnerabilityReport of a known vulnerability in an image

Type

Bug

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions