eMudhra Intermediate CA Key Compromise: Interim Mitigation (v4)

Update: v2.0.1 fixes the Windows script

The Windows script in v2.0.0, remove-emudhra-roots.ps1, removes the roots correctly, but on a Windows gateway it leaves the Windows runtime the gateway hands out to clients, lib\runtime\jre-win.zip, in a form the launchers can't unpack. Windows Designers and Vision Clients launched from that gateway can then fail to start with:

ZipException: only DEFLATED entries can have EXT descriptor

v2.0.1 fixes this.

Ran v2.0.0 on a Windows gateway? Run v2.0.1 on that gateway as the README describes: stop the gateway, run the script, then start it. The script rebuilds the archive and reports it as repaired:. Every Designer and Vision Client then downloads the fixed runtime once, about 45 MB, including any that downloaded the original runtime after you restored jre-win.zip.orig.

Haven't applied the fix yet? Use v2.0.1.

Nothing to do anywhere else: Linux and macOS gateways use the shell script, which isn't affected, and on workstations the Windows script only changes each runtime's trust store.

4 Likes