Read More: A company that vouches for websites had secret keys so weak that 8 of them were cracked
Java, the programming language Teku and Besu run on, doesn’t check whether a certificate has been revoked by default. So Teku’s Docker images kept trusting the bad certificates even after browsers had dropped them.
How validators could lose money
An attacker sitting between a validator and a service it connects to could pose as that service. In its security advisory, Teku said a validator fooled this way could propose a block that pays its fees to the attacker’s address.
A fake external signer, the separate service that holds a validator’s keys, could hand over signatures used to change where rewards go, which Teku ranked as the riskiest setup.
“A default Teku node on mainnet is not affected and needs no action,” the team wrote, adding that “no exploitation has been reported.” Consensys Diligence, Teku’s security partner, initially flagged the problem.
Operators who run Teku or Besu directly on their machines, without Docker, have to update Java themselves, since updating the Ethereum software doesn’t touch Java’s list of trusted certificates. The new Docker images don’t fix Java installed on the host, either.
Anyone still on Java 26 has a harder fix, however. Teku said that version is end of life and won’t get a patched build, so those operators need to move to Java 25.
Leave a Reply