---
schema_version: '1.0'
id: security-20260705-6d07d4
url: https://osv.dev/vulnerability/DEBIAN-CVE-2026-42769
url_hash: 6d07d4402c6b207fe896df8ca2f3838db2088dc0ccb4bea7ff1392b36230c0e2
canonical_url: https://osv.dev/vulnerability/DEBIAN-CVE-2026-42769
source: osv:debian
category: security/os
category_raw: cve/os
region: null
tags:
- cve
- DEBIAN-CVE-2026-42769
- severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- openssl
- Debian
lang: en
published_at: '2026-06-09T17:17:08Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:36:30Z'
status: published
content_hash: ed9bbd4cc6860a1aabc0cf5df97e60b2cf7210dab2848a70eb28bf053ff2e6d7
license_note: full
summary: 'Issue Summary: An error in the callback used to verify the certificate provided
  in a Root CA key update Certificate Management Protocol (CMP) message response rendered
  the certificate validation ineffectual, which could lead to escalation of credentials
  from the Registration Auth'
summary_source: rss
summary_en: 'Issue Summary: An error in the callback used to verify the certificate
  provided in a Root CA key update Certificate Management Protocol (CMP) message response
  rendered the certificate validation ineffectual, which could lead to escalation
  of credentials from the Registration Auth'
entities: []
key_facts: []
related: []
related_auto: []
title: DEBIAN-CVE-2026-42769 — openssl
---

# DEBIAN-CVE-2026-42769 — openssl

## TL;DR
Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Auth

## Key Points
- cve / DEBIAN-CVE-2026-42769 / severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N / openssl / Debian

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
**Advisory:** DEBIAN-CVE-2026-42769

**Affected (your watchlist):**
- `Debian:openssl` 3.0.11-1~deb12u2 → no fixed version listed [rpi]

**Details:**
Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level.  Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate.  One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one.  The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate.  A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code).  An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor.  Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity.  The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

**References:**
- https://security-tracker.debian.org/tracker/CVE-2026-42769

_Data: OSV.dev (upstream: debian) — https://osv.dev/vulnerability/DEBIAN-CVE-2026-42769_

## Source
元記事: [DEBIAN-CVE-2026-42769 — openssl](https://osv.dev/vulnerability/DEBIAN-CVE-2026-42769) — published 2026-06-09T17:17:08Z