Overview
The reported compromise of eMudhra intermediate CA keys can allow an attacker to impersonate a TLS service to a client that still trusts the affected certificate chains. Operating system and browser protections may differ from those used by an application. See the public incident report (https://emudhra.we-have-a-problem.com/).
Gurobi product impact
This vulnerability does not apply directly to Gurobi products or services, and as such, Gurobi cannot provide fixes in the Gurobi products. However, customers using Gurobi in an application or deployment relying on HTTPS connections may be affected. In this case, customers should apply vendor-supported certificate trust fixes for the operating system or distribution used by their deployment whenever available.
In particular, HTTPS connections are used with the following Gurobi products and services:
- Web License Service (WLS),
- Instant Cloud,
- Intelligence Hub,
- and Compute Server/ Cluster Manager deployments when TLS is enabled.
What customers should do
Customers should prioritize vendor-supported certificate-trust fixes for the operating system, distribution, or container image used by the deployment. Update certificate trust inside containers and images where applicable, rebuild and redeploy container workloads, restart affected applications or services, and verify normal Gurobi operation. Use a workaround only when no suitable vendor-supported fix is available and after coordinating with your system administrator and Gurobi Support.
For questions about your Gurobi deployment, contact Gurobi Support.