How Weaviate responded to the eMudhra certificate compromise
By Steven Van ·
Weaviate moved its platform to Go 1.27.3, patching Enterprise customers within six hours and everything else in under 17.
Weaviate patched its entire customer estate and infrastructure platform to mitigate the risk from eight leaked certificates issued by the certificate authority eMudhra. Weaviate described the response in a blog post.
Timeline and scope
The end-to-end process took less than 17 hours. Enterprise customers were patched within six hours. The work involved moving almost every part of Weaviate's environment to Go version 1.27.3.
Who did the work
A task force drew on the core developer, console, platform and agents engineering teams, plus the product support function. The team created and reviewed pull requests, pushed tags, watched promotions and checked that the services' tests passed.
Reporting security issues
Anyone who believes they have found a vulnerability can use Weaviate's Security Report page. Weaviate will acknowledge the report and advise on next steps. It asks researchers not to disclose vulnerabilities publicly until they have been fixed and announced, unless the security team has said they can.