The system must verify that package updates are digitally signed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-219997	SOL-11.1-020020	SV-219997r1016296_rule	CCI-003992	medium
Description
Digitally signed packages ensure that the source of the package can be identified.
STIG			Date
Solaris 11 X86 Security Technical Implementation Guide			2026-02-19

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.2Signed Components

0.50

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-14Signed Components

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(3)Signed Components

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(5)Authorized Software — Allow-by-exception

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(5)Individual Authentication with Group Authentication

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-3Security Function Isolation

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SI-2Flaw Remediation

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-003992

1.00

DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)

Details

Check Text (C-219997r1016296_chk)

Determine what the signature policy is for pkg publishers: # pkg property | grep signature-policy Check that output produces: signature-policy verify If the output does not confirm that signature-policy verify is active, this is a finding.

Fix Text (F-21706r372521_fix)

The Software Installation Profile is required. Configure the package system to ensure that digital signatures are verified. # pfexec pkg set-property signature-policy verify