package: debian-installer severity: important x-debbugs-cc: [email protected]
On Thu, Oct 22, 2026 at 04:18:45PM +0200, Max Vozeler wrote: > Hi everyone, > > I just found this on a customer's systems, which were originally > installed using d-i from an https mirror: > > /usr/local/share/ca-certificates contained copies of all CA certs from > ca-certificates-udeb as of installation time, including the compromised > "emSign ECC Root CA - G3" and "Comodo AAA Services root" certs. > > These will continue to be trusted even after upgrade of ca-certificates > to the fixed version (!) > > I think this comes from: > https://salsa.debian.org/installer-team/base-installer/-/blob/master/debian/bootstrap-base.postinst?ref_type=heads#L174 > > # If we need SSL certificates, copy them in now. > if [ "$PROTOCOL" = "https" -o "$mirror_protocol" = "https" ] && [ -d > /etc/ssl/certs ]; then > if find /etc/ssl/certs/ -name \*.crt | grep -q .; then > mkdir -p /target/usr/local/share/ca-certificates > cp -a /etc/ssl/certs/*.crt > /target/usr/local/share/ca-certificates/ > chroot /target update-ca-certificates || true > fi > fi > > Please check your /usr/local/share/ca-certificates and ensure that it is > empty or only includes CA certs that you meant to put there. > > I haven't filed a bug on base-installer yet; I will try to that tomorrow > if noone beats me to it. > > Best regards, > Max > -- cheers, Holger ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C ⠈⠳⣄ "more than half of the world’s food production will be at risk of failure in the next 25 years" https://www.theguardian.com/environment/2025/jul/02/\ droughts-worldwide-pushing-tens-millions-starvation-report
signature.asc
Description: PGP signature
