Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-109399 →

DEBIAN-CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.5...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 swupdate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 swupdate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.05+dfsg-1"}]}]

Références

advisory security-tracker.debian.org