@Rocky Is starRocks Images are vulnurable to eMudhra CA compromise ?

The eMudhra CA compromise (CVE-2026-111943) is a global security incident disclosed around October 17–21, 2026. It involves the compromise of private keys for eight eMudhra intermediate Certification Authorities (CAs) due to insufficient randomness during key generation. This allows attackers to forge TLS certificates that would be trusted by systems relying on these CAs, potentially enabling man-in-the-middle (MITM) attacks. Impact on StarRocks Like most containerized software, StarRocks images are not "vulnerable" due to a flaw in StarRocks itself, but they may be affected if they trust the compromised eMudhra certificates. 1. Trust Stores: StarRocks Docker images (which typically use Ubuntu or Rocky Linux as base OS) contain a system-wide certificate trust store (

ca-certificates

). If the image was built before October 20, 2026, its trust store likely still includes the compromised eMudhra intermediates. 2. Communication: This compromise primarily affects StarRocks when it acts as a client connecting to external services over HTTPS (e.g., loading data from S3/GCS or communicating with external metadata stores) if an attacker intercepts that connection using a forged certificate. Current Status of StarRocks Images As of October 22, 2026, many official StarRocks images on Docker Hub (such as

starrocks/fe-ubuntu

and

starrocks/be-ubuntu

) may not have been rebuilt yet to include the latest OS-level security patches. * Images updated before Oct 20, 2026: Are likely vulnerable and should be updated or patched manually. * Images updated after Oct 20, 2026: Likely contain the updated

ca-certificates

package from the base OS (Ubuntu/Red Hat/Rocky) that distrusts the compromised CAs. Recommended Actions If you are running StarRocks in production and are concerned about this PKI compromise, take the following steps: 1. Update Images: Check for the latest image tags. If a new version or an updated tag was released after October 21, pull the latest image and redeploy. 2. Manual Patch (Temporary): If you cannot immediately update your images, you can manually update the trust store within your running containers or your Dockerfile: * For Ubuntu-based images:

bash
        docker exec -u root -it <container_id> /bin/bash -c "apt-get update && apt-get install --only-upgrade ca-certificates -y"

* For Rocky/Red Hat-based images:

bash
        docker exec -u root -it <container_id> /bin/bash -c "dnf update ca-certificates -y"

3. Verify: After updating, you can verify if the trust store has been patched by checking for the removal of eMudhra/emSign certificates from the local bundle or by following guidance from your OS vendor (e.g., Ubuntu Security Notices or Red Hat Advisories). For the most authoritative information, monitor the official StarRocks GitHub repository for security advisories or the CelerData security page. References • best_practices/authentication_authorization.md • faq/Others.md • faq/Deploy_faq.md • administration/http_interface/query_detail.md • faq/resource_isolation_faq.md • administration/Meta_recovery.md • administration/management/logs.md • administration/user_privs/authorization/User_privilege.md