points by boston_clone 1 day ago | 0 comments
Same here - I genuinely thought this would have been easily, and almost immediately, remediated vis-a-vis CRLs. I'm not in the vuln management space anymore, but is there some sort of caching system used which would affect software differently than a typical browser?
Editing to add a link to this Apple support article which is unsurprisingly detailed - https://support.apple.com/en-us/149555
[–] zerocrates 1 day ago
[–] boston_clone 1 day ago
Yes, exactly what the Apple article highlights! Appreciate the extra context.
CLI-based activity references etc/ssl/cert.pem. While they say this will be updated in the future (likely the next dot release), admins can also proactively remove the eMudhra entries.
Similar reason (though with the opposite effect) as how a cert can be fine for browsers but fail for curl when they don't send an intermediate: the "vanilla"/library/command-line stuff is just checking for a path to a trusted cert and not doing the CRL or AIA stuff a browser does.