Executive brief
mport is the package manager for MidnightBSD, responsible for downloading and installing software packages. Prior to version 2.7.8, the package manager accepted non-HTTPS URLs for repository and package mirror downloads, allowing a network attacker to intercept and modify package files or repository indices, potentially delivering malicious software to users.
Technical details
The vulnerability exists in libmport/fetch.c where the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() functions failed to enforce HTTPS when fetching package indices and bundles from repositories or mirrors. An attacker positioned on the network path (e.g., via ARP spoofing, DNS hijacking, or BGP hijacking) can intercept cleartext HTTP traffic and inject malicious package data or forge repository index entries. The fix (version 2.7.8) adds a url_is_https() enforcement check to require all fetches use HTTPS, preventing plaintext transport-layer tampering. No authentication bypass or file write vulnerability is present; the issue is purely about transport security.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-09-17: disclosed
- 2026-05-14: patched: Fixed in version 2.7.8