CVE-2026-54578: mport verify can compare stale checksum data after hashing failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mportverifypackage() in libmport/verify.c could continue after MD5File() or SHA256File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
midnightbsd/mportto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using MidnightBSD Package Manager versions before 2.7.8 are affected when package verification hashes installed files and a hash operation fails. An attacker would need to influence an installed file or the conditions causing MD5File() or SHA256_File() to fail.
What is the practical impact of a hashing failure on an affected version?
mport_verify_package() can compare the expected checksum against stale hash-buffer contents instead of a newly computed digest. This can produce a misleading integrity result and may hide a checksum failure.
How can this be remediated?
Upgrade mport to version 2.7.8, which fixes the failure handling in package verification.