Hi Max, Max Vozeler <[email protected]> (2026-10-22): > I just found this on a customer's systems, which were originally > installed using d-i from an https mirror: > > /usr/local/share/ca-certificates contained copies of all CA certs from > ca-certificates-udeb as of installation time, including the compromised > "emSign ECC Root CA - G3" and "Comodo AAA Services root" certs. > > These will continue to be trusted even after upgrade of ca-certificates > to the fixed version (!) > > I think this comes from: > https://salsa.debian.org/installer-team/base-installer/-/blob/master/debian/bootstrap-base.postinst?ref_type=heads#L174 > > # If we need SSL certificates, copy them in now. > if [ "$PROTOCOL" = "https" -o "$mirror_protocol" = "https" ] && [ -d > /etc/ssl/certs ]; then > if find /etc/ssl/certs/ -name \*.crt | grep -q .; then > mkdir -p /target/usr/local/share/ca-certificates > cp -a /etc/ssl/certs/*.crt > /target/usr/local/share/ca-certificates/ > chroot /target update-ca-certificates || true > fi > fi > > Please check your /usr/local/share/ca-certificates and ensure that it is > empty or only includes CA certs that you meant to put there. > > I haven't filed a bug on base-installer yet; I will try to that tomorrow > if noone beats me to it.
Ouch. That seems to date back to the original implementation (all the way back to 2014), so this isn't an exactly recent change/regression of some kind… Somewhat good news (maybe): it seems the default deb.debian.org that's getting offered still leads to an HTTP-only (not HTTPS) installation and we don't hit that particular code path. So we're not talking about most installations' being misconfigured/vulnerable in this way (if this laptop installed with D-I Trixie RC 3 is indeed representative of Debian 13 systems). Where and how to go from here isn't entirely clear to me at this point. Wild guess, if we still need that manual copy/deployment in this specific location, we could still have some kind of cleanup some finish-install script, that would get rid of all files that are (currently) shipped by ca-certificates, so that we only keep any “really local” certificates in there on the long run? Also, maybe I could have caught that when I hacked together commits ee95d8a89a0a and 7a79b4556436… :( Is deploying ca-certificates at this point sufficient to make the manual copy of the whole directory's contents moot? Help more than welcome! Cheers, -- Cyril Brulebois ([email protected]) <https://debamax.com/> D-I release manager -- Release team member -- Freelance Consultant
signature.asc
Description: PGP signature
