Security issue thread - PHP and eMudhra cert compromise
-
@Lanhild What if the app gets started when an update is available, but the network gets disconnected somehow. Maybe by killing the nginx/proxy/ports temporarily? There's got to be a virtual equivalent to "cutting the ethernet cable", right?
-
From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
Relatively impossible to estimate. Usually, vulnerability scanners don't check whether your application runs or not. They simply send requests indefinitely, until they have a hit.
Anyhow, updating stopped apps isn't technically feasible.
-
-
It just doesn't stop.. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
-
-
@bazinga not exclusively. The same principle applies to pretty much any application outside Cloudron too. Sometimes, updates need to trigger hooks or migrations that require the application to be up. That's the main reason why.
-
Nextcloud's bundle still includes emSign ECC Root CA - G3 which Cloudron has no control over. But, maybe someone at Cloudron can report it to Nextcloud.
-
Also, while auditing for the eMudhra issue, I found certifi 2026.1.4 in the Python 3.14 virtual environment (/app/code/venv) of my Baserow app, io.baserow.cloudronapp@1.40.3 (Baserow 2.4.1). That is the current App Store version. I uninstalled it since I was not using it. Notification log shows it updated to that version last week.
-
-
We don't use upstream Nextcloud but have our own package. It's built with the ubuntu that has the security fix as well as latest PHP.
We don't use upstream Nextcloud but have our own package. It's built with the ubuntu that has the security fix as well as latest PHP.
Specifically, the cert in /app/code/resources/config/ca-bundle.crt within the NextCloud container.
If you run
docker exec [nextcloud-containter-id] curl -sS -o /dev/null --cacert /app/code/resources/config/ca-bundle.crt https://dv-g3b-emudhra.we-have-a-problem.com/it goes through, proving the cert trusts the compromised chain. -
-
Hello @recliner2042
This has already been reported to Nextcloud there is not much we can do.What about Baserow?
-
-
Hello @recliner2042
Baserow already fixed the issue https://github.com/baserow/baserow/pull/6494, but it is not yet released.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login