Security: Statement about compromised eMudhra CA certificates

We are aware about the eMuhdra Intermediate CA Compromise. While the compromise itself is not an immediate security issue, it allows attackers that are able to run man-in-the-middle (MITM) attacks to do this without the user noticing and hence can intercept all traffic. Performing a MITM attack is not straight-forward as it requires either control of a DNS server or access to network infrastructure. The clients might make requests to forged hosts and the compromised CA certificates allow the attacker to present a valid and trusted certificate, which means the user will not notice anything (e.g. a certificate mismatch warning/error).

We checked our products against the possibility of such an attack.

🟢 A default KNIME Business Hub installation does not make requests to cluster-external hosts, except the cloud providers’ or your own infrastructure such as RDS or S3. Therefore a MITM attack using the compromised certificates is close to impossible (except if AWS, Azure our your own infrastructure themselves are compromised). The next KNIME Business Hub bugfix releases will contain updated base images that do not trust the compromised certificates any more.

🟡 Workflows created in KNIME Analytics Platform might call out to external services which could theoretically be intercepted by a MITM. The risk is pretty low as already described above. We will add the compromised certificates to the JRE’s blacklist in the next bugfix releases. In the meantime you can run the scripts in the attached ZIP file in order to add the certificates to the blacklist yourself. Requests to destinations that present certificates signed by the blacklisted CA certificates will fail immediately.

🟢 KNIME Server does not make any requests to external hosts except your infrastructure (e.g. LDAP server, RabbitMQ). Therefore a MITM attack using the compromised certificates is close to impossible. We recommend updating your system’s JRE or add the compromised CA certificates to the JRE’s blacklist as decribed in the section above.