Skip to main content
Stanford
Research Computing Globus

Globus response to eMudhra Intermediate CA Compromise

Several days ago, the private keys for several Intermediate Certificate Authorities—owned by eMudhra Incorporated in the US and eMudhra BV in the Netherlands—were made public (the “eMudhra compromise”). As a result, those CAs were revoked, along with “emSign Root TLS CA - G3”, the root CA that issued them (the “emSign Root”). Read more about the compromise.

Several Globus products include a database of trusted Certificate Authorities, which includes the emSign Root. If you use any of these Globus products, you need to take action:

Globus Connect Personal

If you are using Globus Connect Personal (GCP), upgrade to version 3.3.2.

Globus checks for updates when it launches, so the next time you start GCP, it should ask to upgrade. If GCP is already running, right-click on the Globus menubar/toolbar icon, then choose “Check for updates”.

If any transfers are running when you update GCP, they will automatically resume within a few minutes.

Normal GCP use is not affected by the eMudhra compromise. The part that is affected is the part which handles registration of a new GCP Endpoint. The GCP registration program includes its own copy of Python, which needs to be updated.

If you keep a local copy of the GCP installer (for example, on a share drive), you should replace it with the latest version. You can get the latest GCP installer from the Globus web site.

Globus Python SDK

There are two currently-supported major versions of the Globus Python SDK, versions 3 and 4. If you use version 3, upgrade to version 3.66.0; if you use version 4, upgrade to version 4.10.0.

The Python SDK does not include any CAs itself, but it does require the certifi package. Upgrading the Python SDK ensures that certifi is updated.

Globus Compute SDK

The Globus Compute SDK does not need to be updated. But, if you use the Globus Compute SDK, you will also have the Globus Python SDK installed; that will need to be upgraded.

Globus CLI

If you are using the Globus command-line tools (the Globus CLI), upgrade to version 3.44.0.

Depending on how you installed the CLI, this could be as simple as running globus update. If you installed the CLI using pip, pipx, or similar, use that tool to upgrade the globus-sdk and globus-cli pacakges.

Like the Python SDK, the CLI does not include any CAs itself, but it does require the certifi package. Upgrading the CLI ensures that certifi is updated.

Globus Compute Endpoint

There are two ways to install the Globus Compute Endpoint: You can install the Compute Endpoint through PyPi, or you can install the Compute Endpoint through your OS package manager (via the globus-compute-agent package).

If you installed the Compute Endpoint from PyPi, you will also have the Globus Python SDK installed, and that will need to be upgraded.

If you installed the Compute Endpoint through your OS package manager, upgrade to either version 4.17.1-2, 4.18.0-2, or 4.19.0-2.

After updating, restart the Endpoint.

Globus Connect Server

If you are running Globus Connect Server (GCS), upgrade to version 5.4.99. Follow either the single-Node procedure or the multi-Node procedure.

If any transfers are running when you upgrade GCS, they will automatically resume within a few minutes.

Since Globus Connect server supports so many different Linux distributions, GCS includes its own copy of Python, which it installs at path /opt/globus. That Python installation includes certifi, botocore (used for communications with Amazon S3), and pip (which itself includes a copy of certifi). Upgrading GCS packages will upgrade those copies of certifi and botocore.

Older GCS Versions

Some Endpoint administrators are unable to upgrade Globus Connect Server. If this is true for you, there is a workaround: You can manually update the CA-certificates lists used by botocore and certifi.

Download the bundle of CA Root Certificates from the Curl web site. This bundle is sources from Mozilla’s root certificates file.

You will be copying the downloaded file to three locations on your DTN:

  • /opt/globus/lib/python/site-packages/certifi/cacert.pem

  • /opt/globus/lib/python/site-packages/botocore/cacert.pem

  • /opt/globus/lib/python/site-packages/pip/_vendor/certifi/cacert.pem

Before copying, check the permissions of the existing files. After copying, make sure permissions are still correct (including SELinux label/context, if you are using SELinux).

After the copy is complete and permissions are fixed, restart the gcs_manager and gcs_manager_assistant services. If you use the Globus OIDC server, also restart the globus-oidc service.

Finally, check that the GCS API is still working: Run globus-connect-server endpoint show; if the GCS API is working, you will see information about your Endpoint.

Check the rest of the OS!

Besides Globus, your computer probably has other things that need to be updated.

Check the “Who has patched?” list on the eMudhra Intermediate CA Compromise, and update all the things.