News for hackers. Stuff that matters.

A comment on CVE-2023-40547 – avoid incorrectly trusting HTTP headers. Parent comment

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by rany_ on Thursday January 25, 2024 @02:33PM (#39134014)
To my knowledge, they aren't the ones signing the software. Microsoft runs a UEFI CA and just bless the developer's sub-CA. The developer is fully in control of their own CA and could sign whatever they want.
[ Parent | on HN ]
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by AshamedCaptain on Thursday January 25, 2024 @02:49PM (#39134226)
No. I don't know if Microsoft "partners" have some special privilege, but for 3rd parties Microsoft will _never_ sign your CA. They sign individual binaries.
[ Parent | on HN ]