On 22/10/2026 at 16:48, Cyril Brulebois wrote:
Max Vozeler <[email protected]> (2026-10-22):
I just found this on a customer's systems, which were originally
installed using d-i from an https mirror:
/usr/local/share/ca-certificates contained copies of all CA certs from
ca-certificates-udeb as of installation time, including the compromised
"emSign ECC Root CA - G3" and "Comodo AAA Services root" certs.
(...)
Somewhat good news (maybe): it seems the default deb.debian.org that's
getting offered still leads to an HTTP-only (not HTTPS) installation and
we don't hit that particular code path. So we're not talking about most
installations' being misconfigured/vulnerable in this way
Besides, AFAICS it happens only with netboot d-i or if a https mirror is
preseeded, not when installing from regular ISO images without preseeding.
Also, maybe I could have caught that when I hacked together commits
ee95d8a89a0a and 7a79b4556436… :( Is deploying ca-certificates at this
point sufficient to make the manual copy of the whole directory's
contents moot?
Testing on netboot with certificate copy disabled -> works fine here.
