CyberRota Analysis
AI-GeneratedThe MidnightBSD Package Manager prior to version 2.7.8 contains a vulnerability in the mport_verify_package() function, where it may erroneously proceed after a hashing failure, leading to the comparison of expected checksums against outdated data. This flaw could allow an attacker to manipulate installed files or exploit conditions that cause hashing to fail, resulting in misleading integrity checks. Users of MidnightBSD, particularly those managing critical systems or sensitive data, should prioritize upgrading to version 2.7.8 to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.