Intermediate CA compromised. Impact: Silent MITM possible for Tor Browser. Worse for Tor since exit nodes untrusted. Debian CA list updated fixes curl. TB uses custom CA list, not yet patched.
TB fix merged, not released. Fix possibly wrong. See comments. https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/2278
If TB unable to resolve quickly, should Whonix separately attempt fix?
I can’t immediately confirm that Tor Browser holds its certificate store outside of a browser binary. I tried looking for files with the strings cert, pki, crt, pem, .db, x., 509 (and possibly others I’ve forgotten) and found no files related to certificates under ~/.tb/tor-browser/Browser on a Whonix system. I suspect the only way to update the cert store is to rebuild the browser, and that is something we are not capable of doing. (Not to mention the fact that the Tor Project is skilled at modifying and building their own browser, so the chances of them not being able to get a fix out quickly is pretty slim.)
Thankfully, users who rely on onion services for security should be less impacted than those who rely purely on TLS, which has been broken many times in similar ways and should be treated as untrustworthy when possible. See: