TxPipe Patches Certificate Trust Issue in Four Cardano Tools

TxPipe announced security patches for four of its open-source Cardano infrastructure tools on October 22. The team said the updated releases stop trusting eMudhra intermediate certificate authorities whose private keys can be derived.

The release lineup includes Dolos 1.6.2, Oura 2.2.1 and 1.9.5, Balius 0.5.4, and a patched container image for Boros. TxPipe’s announcement does not report exploitation against its users or losses of funds.

Patches Remove Trust in Affected Certificates

Certificate authorities help applications verify the identity of servers when establishing TLS connections, which protect network communications. Intermediate authorities form part of the certificate chain that software checks before accepting a connection.

If an authority’s private key can be reconstructed, an attacker could potentially issue certificates that affected software would trust. Exposure depends on how an application validates certificates and which connections it makes.

TxPipe’s updates address this problem in the networking components supporting its tools. The announcement concerns application infrastructure rather than a vulnerability in Cardano’s consensus protocol.

Four Tools Support Different Parts of Cardano Applications

The affected projects serve distinct infrastructure roles. Dolos provides access to Cardano blockchain data, while Oura monitors on-chain events and forwards them to systems such as databases and message brokers.

Balius provides tools for building and running Cardano application logic independently of a particular user interface. Boros focuses on transaction submission infrastructure for applications handling sustained submission workloads.

For Dolos, version 1.6.2 updates the v1 long-term support branch. TxPipe says Mithril bootstrapping, snapshot restoration, and OpenTelemetry export use rustls with the relevant security fixes. The team also rebuilt the container image with Debian’s patched certificate bundle.

Those changes address both application dependencies and the trusted certificates supplied in the container environment. Other projects have their own patch details; Dolos’s implementation should not be treated as a description of every release.

[NEWSBREAK]

Deployment Updates Depend on the Installed Tool

The fixes are available through different release lines and distribution formats. Oura has patched versions for both its v2 and v1 branches, while Boros’s announced update is delivered as a container image.

Operators using these tools need to match the patched package to their deployed version and installation method. An updated release becomes effective for a service once its running deployment incorporates the fix.

Pallas is excluded from this patch cycle. TxPipe says the library has no TLS client and therefore requires no new release for this issue.