Harry Sintonen
@harrysintonen@infosec.exchange
With this #GitHub runner vulnerability in place, dependencies could have been tampered with and malicious payloads injected into the built software. Any software built with these runners since the #eMudhra was made public and until the runners are fixed must be considered compromised.
yossarian @yossarian@infosec.exchange · open
GitHub's macOS runners are unfortunately still vulnerable to the eMudhra CA compromise, meaning that any TLS traffic that goes through the system Git, curl, etc. is MITMable.
(success in the CI matrix below means the runner made a TLS connection that it absolutely should not have.)