Apple warns Mac command-line tools can still trust compromised certificates

Apple says some command-line tools supplied with macOS or Xcode, including curl and git, can still accept compromised eMudhra certificates while a software fix is pending. Safari, Mail and applications using Apple's networking and security frameworks already block the affected certificates automatically. Private keys for six eMudhra authorities that issue website certificates were compromised, allowing their holders to create certificates that appear valid for any website. Apple advises administrators who want earlier protection to remove relevant root certificates from the file these tools use to check trust. That workaround can also prevent verification of some unaffected websites, and software updates can replace the edited file.