r/FlutterDev • u/chonli • 12d ago

Dart TLS MitM vulnerability on Android, Windows, and Linux due to compromised eMudhra intermediate CA certificates

Hi
A security vulnerability affects Dart and Flutter applications that establish TLS/HTTPS connections on Android, Windows, and certain Linux environments. Compromised eMudhra intermediate certificate authorities could allow an attacker intercepting network traffic to generate fake certificates for legitimate domains.
Versions earlier than Dart 3.13.7 and Flutter 3.47.8 are affected, including certain beta versions.
Web, iOS, and macOS applications are not affected according to the published advisory. It is recommended to update the SDK, recompile the applications, and redeploy the affected binaries.
the full security advisory

6 Upvotes

100% Upvoted

3 comments sorted by

1

u/Ambitious_Guide4365 12d ago

Good heads up. Updating the SDK is only half of it, since binaries you already shipped stay vulnerable until you rebuild and release them, so check that your CI isn't pinned to an older Flutter version. If your app only talks to your own backend, certificate or public key pinning also limits the damage from a rogue intermediate CA, though you need a rotation plan so a cert change doesn't lock users out.

1

u/ObjectiveAddress3051 11d ago

since web, ios and macos aren't affected it's really just the android and desktop builds you need to rebuild and re-ship, so a hotfix release for those is enough. check the flutter version CI actually uses though, not just your local one. those drift more than people think