Debian 13.6 “trixie” Update Patches 100+ Advisories, Fixes Expired Secure‑Boot CA
What Happened – Debian released point release 13.6, updating the UEFI Secure Boot certificate authority, shim, and more than a hundred security advisories across core packages (curl, apache2, qemu, Python 3.13, etc.). The update also adds tooling (fwupd 2.0.20) to refresh the Secure Boot CA, KEK, and DBX on affected machines.
Why It Matters for Compliance & Audit Readiness
- Unpatched firmware or OS components constitute a control gap that can invalidate SOC 2 Security (CC6.1) and Availability (CC7.1) criteria.
- Continuous patch management and evidence of timely remediation are core audit artifacts; Verisq’s Control Mapping capability automates collection of patch‑install logs for the Trust Center.
- The Secure Boot CA expiration illustrates how supply‑chain misconfigurations can surface; documenting remediation actions demonstrates due‑diligence in vendor‑risk and change‑management controls.
Who Is Affected – All organizations running Debian 13 (servers, workstations, embedded devices) across industries – notably cloud‑infrastructure providers, SaaS platforms, and enterprise IT departments.
Recommended Actions
- Verify that fwupd 2.0.20 is deployed and that the Secure Boot CA, KEK, and DBX are refreshed on every Debian 13 host.
- Run a full package inventory (e.g.,
apt list --upgradable) and apply the 13.6 point release within your patch‑management window. - Capture patch‑install logs and map them to SOC 2 Control CC6.1 (Vulnerability Management) as continuous audit evidence.
Technical Notes – The update addresses:
- Expired UEFI Secure Boot CA (affects bootloader verification).
- Shim SBAT revocation level set to 2025021800; new installer checks for boot failures.
- Curl fixes: bearer‑token leakage, CA reuse, SMB use‑after‑free, STARTTLS credential leak.
- Apache 2.0: 13 flaws (UAF, XSS, buffer overflows, DoS, out‑of‑bounds reads).
- QEMU: 25 security fixes (memory corruption, privilege escalation).
- Python 3.13: CR/LF injection, DoS, path traversal, SSRF.