On 26/10/2026 08:57, Be33eD wrote:
## Summary
When an operator verifies a trusted checksum manifest containing standard
SHA2 tagged lines with different digest lengths using
`cksum -a sha2 --check`, the first tagged line overwrites a global
algorithm selector. Subsequent valid SHA2 lines with a different digest
length are then treated as improperly formatted and skipped. An attacker
who can modify unchecked data files, but cannot modify the trusted
manifest, can therefore make the command report success.
I was actually looking at this and a similar issue in the last day or so.
I'll post adjustments soon.
thanks,
Padraig
