CyberRota Analysis
AI-GeneratedThe MidnightBSD Package Manager is vulnerable to integrity loss and potential denial of service due to improper handling of truncated or corrupt zstd streams in versions prior to 2.7.8. This flaw allows a malicious or faulty mirror to supply compromised compressed package index data, which can lead to incomplete or erroneous package installations. Users and administrators of MidnightBSD should prioritize upgrading to version 2.7.8 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused ZSTD_decompressStream() or an output write to fail while leaving partial index output available for later use, resulting in package-index integrity loss or denial of service. This issue is fixed in version 2.7.8.