Ethereum clients patch flaw that could redirect ETH rewards

Ethereum client developers Teku and Besu have released security updates to address a certificate vulnerability that could allow attackers to impersonate services used by validators and potentially redirect their block rewards. Summary Ethereum clients Teku and Besu have released security updates after a certificate vulnerability was found that could allow attackers to redirect validator block rewards to their own addresses. The vulnerability originated from weak cryptographic keys associated with eight certificate authorities operated by Indian company eMudhra, which could allow attackers to create fraudulent certificates. Teku warned that attackers could impersonate external services used by Ethereum validators and manipulate block proposals or obtain sensitive validator signatures under certain configurations. Default Teku mainnet configurations were not affected, and developers confirmed that no exploitation of the vulnerability had been reported. Operators using standalone Teku or Besu installations must update their Java environments separately, as the latest Docker image fixes do not automatically update locally installed Java certificates. According to security advisories ac...