Monthly
Isar 0.11 and later create /etc/apt/trusted.gpg.d during bootstrap as the calling build user rather than root, so the apt keystore inside the generated image carries non-root ownership. If that build user's uid happens to match an unprivileged account inside the image, whoever controls that in-image account can rewrite existing repository signing keys or drop in new ones and quietly defeat apt's repository integrity checks. Exploitation is local only and conditional: per the advisory, key tampering is just one link in a chain and must be paired with manipulation of a remote repository or interception of non-secure apt traffic, and images with an immutable rootfs or that never invoke apt are unaffected. No public exploit code was identified at time of analysis and there is no KEV entry; the assessed risk is medium-severity with low-to-moderate real-world urgency, suited to a normal monthly patch cycle.
Isar 0.11 and later create /etc/apt/trusted.gpg.d during bootstrap as the calling build user rather than root, so the apt keystore inside the generated image carries non-root ownership. If that build user's uid happens to match an unprivileged account inside the image, whoever controls that in-image account can rewrite existing repository signing keys or drop in new ones and quietly defeat apt's repository integrity checks. Exploitation is local only and conditional: per the advisory, key tampering is just one link in a chain and must be paired with manipulation of a remote repository or interception of non-secure apt traffic, and images with an immutable rootfs or that never invoke apt are unaffected. No public exploit code was identified at time of analysis and there is no KEV entry; the assessed risk is medium-severity with low-to-moderate real-world urgency, suited to a normal monthly patch cycle.