Debian Patches

Status for swupdate/2022.12+dfsg-4+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
CVE-2025-41259.diff Verify that a path is a directory before cleanup
If swupdate_remove_directory is called without a directory, a
preesistent file was present and then give up.		 Stefano Babic <stefano.babic@swupdate.org> no upstream, f4bd64260e233e207354d68d572b1cbc3e63689d 2025-12-18
CVE-2026-28525.diff mongoose: Integer Underflow in Multipart Upload Parser
The function mg_http_multipart_continue_wait_for_chunk() has
a discrepancy between its guard condition and a subsequent
subtraction in the else branch. The guard at line 250 checks
`(int) io->len < mp_stream->boundary.len + 6`, allowing execution
to continue when io->len >= boundary.len + 6.
However, when mg_strstr() finds the boundary string in the
buffer (else branch at line 264), data_len is computed as
`io->len - (mp_stream->boundary.len + 8)`. The +6 vs +8
mismatch means that when io->len is in the range [boundary.len + 6,
boundary.len + 7], the subtraction underflows the size_t
variable to SIZE_MAX or SIZE_MAX - 1.

This will fix CVE-2026-28525.

Description of issue copied from vulnerability report - many thanks to
Kazuma for his analyses.

Reported by: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc."		 Stefano Babic <stefano.babic@swupdate.org> no upstream, beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 2026-03-19
CVE-2026-109399.diff Add config option to ignore certs in CMS payload for cert validation
The CMS SignedData structure defined in RFC 5652 allows embedding
additional X.509 certificates in the signature data. This is mainly used
to transport the signing certificates for validation, but also allows
including additional certificates that are used during certificate
chain validation.

While these certificates are treated as "untrusted", there are cases
where this can be harmful for how we use CMS in swupdate. Consider the
following real-world example:

+---------+ +-----------+ +---------------+
| Root-CA |------>| CA-prod |------>| swu-sign-cert |
+---------+ +-----------+ +---------------+
|
| +------------+ +----------------+
+------------->| CA-devel |---->| some-sign-cert |
+------------+ +----------------+

Root-CA signed multiple intermediate CAs (CA-prod and CA-devel).
Each of these intermediate CAs has a different purpose and signed
one or more leaf signing certificates. In swupdate we use
`-k ca-chain.crt` to supply the root CA and CA-prod certificate chain
as trusted certificates. Every update file will contain the
swu-sign-cert and the respective signature. When swupdate verifies
this signature, it will verify that the certificate chain ends in a
trusted certificate.

CMS however also allows to include certificates used for chain
construction in the CMS structure that is signed. This means we can
also use some-sign-cert to sign a malicious update file and include
CA-devel in the update file. According to the CMS specification these
additional certificates will be treated as untrusted, but will be used
in certificate chain construction. If a valid chain ending in a trusted
certificate can be constructed, the signature check passes and swupdate
will install the malicious update.

Add the option CONFIG_CMS_IGNORE_ADDITIONAL_CERTS to strictly ignore
any CMS-transported certificates besides the direct signing certificates
themselves during certificate verification.

As there are still legitimate use cases for delivering intermediate
certificates via the CMS SignedData such as an expired intermediate CA
in the trust store, the option is off by default.		 David Gstir <david@sigma-star.at> no upstream, 00b9129e1e496da2d217d439759c4661fb1e21ad 2026-01-29
Link-config-to-swupdate-www-path.diff example: Link config to swupdate-www path Bastian Germann <bage@debian.org> not-needed 2022-11-28
Replace-Font-Awesome-5-with-Fork-Awesome.diff Replace Font Awesome 5 with Fork Awesome Bastian Germann <bage@debian.org> not-needed 2022-11-25
use-gcc-compiler.diff Use gcc compiler
Use explicit gcc to enable cross compiling.
crossprefix-cc will not be available generally on Debian.		 Bastian Germann <bastiangermann@fishpost.de> no 2020-05-28

All known versions for source package 'swupdate'

Links