Executive brief
mport is the package manager for MidnightBSD, a BSD-derived operating system. Prior to version 2.7.8, mport failed to properly validate corrupted or truncated package index data downloaded from mirrors. An attacker controlling a mirror could serve malformed compressed indexes that mport would partially accept, leading to corrupted package metadata being used for subsequent operations or service disruption when index verification fails.
Technical details
The vulnerability exists in libmport/util.c's mport_decompress_zstd() and libmport/fetch.c's index-fetch logic, which did not consistently handle failures in ZSTD stream decompression or fwrite output operations as fatal errors. A malicious or faulty mirror could supply truncated or corrupt zstd-compressed package index data; the decompressor would fail to complete the stream or write output, but the partial index data would remain available for later use rather than being immediately rejected. The fix (version 2.7.8) hardens validation by treating all decompression and write failures as fatal, propagating errors to callers, and unlinking incomplete output files to prevent downstream consumption of corrupted metadata. The attack vector requires the attacker to compromise or intercept a package mirror that the target system trusts.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-09-17: disclosed
- 2026-05-15: patched: Fix merged in version 2.7.8