Private keys belonging to eMudhra, a certificate authority, were exposed. With these keys, someone could create website certificates that some software would wrongly trust. To misuse them, an attacker would also need to intercept network traffic. Major browsers and operating system vendors have released, or are releasing, updates that stop trusting the affected certificates.
- H2O.ai does not use eMudhra certificates, so there are no certificates to replace.
- We updated a standard list of trusted certificates that are shipped with base images and removed the affected ones.
If you have questions, contact your H2O.ai Customer Success manager or our security team at security@h2o.ai.