Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Loki package may accept revoked certificates
published 23 days ago
Summary
The Loki software can fail to recognize when a signing key has been revoked, allowing potentially untrusted code to be accepted as valid. This could let attackers introduce malicious components that appear legitimate. Update Loki to the latest version or apply the vendor’s patch to ensure revoked keys are correctly blocked.
What to do
- Update cleanstart loki to version 3.7.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
Original advisory text
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-ZW28198 · OSV
Track software like this
Free during beta