Fixed packages are now available so you need to perform YunoHost system upgrade as soon as possible AND TELL YOUR USERS TO UPDATE THEIR DEVICES.
via the Web UI: go at https://domain.tld/yunohost/admin/#/update, click “Retrieve available updates”, and then “Upgrade” under the “System” section
via SSH: sudo yunohost tools update && sudo yunohost tools upgrade system
IF you’re still using Yunohost 11 (?!!!), you should apply the patch manually (and consider upgrading to Yunohost 12, which will soon no longer be supported) :
Des correctifs sont disponibles et vous devriez mettre à jour les paquets système de votre instance YunoHost dès que possible ET DIRE A VOS USAGER⋅ES DE METTRE A JOUR LEURS EQUIPEMENTS.
via l’interface web: allez sur https://domaine.tld/yunohost/admin/#/update, cliquez sur “Récupérer les mises à jours disponibles”, puis sur “Mettre à jour” sous la section “Système”.
via SSH: sudo yunohost tools update && sudo yunohost tools upgrade system
SI vous utilisez encore Yunohost 11(?!!!). Vous devriez patcher manuellement (et songer à mettre à jour vers yunohost 12 qui ne sera bientôt plus supporté):
Si j’ai bien tout compris; il s’adit d’un problème d’autorité de signature de certificat SSL.
En gros quelqu’un pourrait générer un faux certificat valide et ce faire passer pour le vrais site internet. Et donc récupérer, en claire, les informations (identifiant, mot de passe, …) qui transite entre le client et le serveur même si la connection est dite “sécurisé” par le navigateur.
I have the same situation, amd64 machine, did the critical php update earlier and that included ca-certificates too, but it’s not clear if the system is still vulnerable.
Edit: ca-certificates is at version 20250419~deb12u2, one of the patched versions.
I’ve received the PHP update a few hours ago, but I’m not aware of an update related to X.509 cert. I’ve just checked again. Maybe it was installed automatically though. The logs are short and the last one’s are filled with automatic updates. So I can’t know.
Yunohost 12.1.41.2
Curl-test
**curl https://dv-g3b-emudhra.we-have-a-problem.com/**
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above
**curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/**
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
@NathanU , @Vinz or everybody who have already done the update and still see the <h1>hello</h1> answer for curl https://dv-g3b-emudhra.we-have-a-problem.com/
@ljf thanks again for your help, I should be able to get that content later today.
Is there a central repository showing which contents those files should have on a default YNO installation? That would allow to quickly check we are not missing package repos, etc…
$ curl https://dv-g3b-emudhra.we-have-a-problem.com/
Your client successfully connected to the site. That's bad!
$ cat /etc/apt/sources.list /etc/apt/sources.list.d/*
deb [ arch=armhf ] http://raspbian.raspberrypi.com/raspbian/ bookworm main contrib non-free rpi
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://raspbian.raspberrypi.com/raspbian/ bookworm main contrib non-free rpi
deb [signed-by=/etc/apt/trusted.gpg.d/extra_php_version.gpg] https://packages.sury.org/php/ bookworm main
deb http://archive.raspberrypi.com/debian/ bookworm main
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://archive.raspberrypi.com/debian/ bookworm main
deb [signed-by=/etc/apt/trusted.gpg.d/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main
deb [signed-by=/usr/share/keyrings/yunohost-bookworm.gpg] http://forge.yunohost.org/debian/ bookworm stable
Running 12.1.41.2 on a Raspberry Pi 2, update page shows “Tous les packages système sont à jour !”
$ cat /etc/apt/sources.list /etc/apt/sources.list.d/*
deb http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free rpi
# vinz:2026-10-21: removed non-free-firmware as it was causing errors
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free non-free-firmware rpi
deb https://packages.sury.org/php/ bookworm main
deb http://archive.raspberrypi.org/debian/ bookworm main
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://archive.raspberrypi.org/debian/ bookworm main
deb [signed-by=/etc/apt/trusted.gpg.d/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main
deb [signed-by=/usr/share/keyrings/yunohost-bookworm.gpg] http://forge.yunohost.org/debian/ bookworm stable
As of tonight, I have refreshed the package lists and picked up a new round of php-related package updates but nothing related to the certificates (I still run with the manual override).
I cannot seem to find which package owns the /etc/ca-certificates.conf file:
$ dpkg -S /etc/ca-certificates.conf
dpkg-query: no path found matching pattern /etc/ca-certificates.conf
The closest I could find is the update-ca-certificates binary, here is its associated package status:
$ which update-ca-certificates | xargs dpkg -S
ca-certificates: /usr/sbin/update-ca-certificates
$ dpkg -l ca-certificates
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===============-================-============-=================================
ii ca-certificates 20250419~deb12u1 all Common CA certificates
An X.509 certificate authority has been compromised.
Une autorité de certification x509 a été compromise.