Invalid digital signature on AcrobatDCx64Upd2300620380.msp

[Patch My PC]

We are seeing the URL https://ardownload2.adobe.com/pub/adobe/acrobat/win/AcrobatDC/2300620380/AcrobatDCx64Upd2300620380.m... download a file producing different SHA256 values in some regions across the world.

In the UK, we see a SHA 256 of 1A0CCAF7C71C7A542D32328C8F51BAFED3E9D66798D1BE68A0FD8B66D3F1E465. In the US, we're seeing a SHA 256 of 6C601B8BFA0A43059FD50521191C08CE1AFAD5E0D8817B13E6D49C021C2D9B01.

Upon inspecting the .msp files downloaded in both regions, they seem to be identical with the only exception being the UK one has a broken digital signature (although it's signed with the same certificate compared to the US one.)

Running Get-AuthenticodeSignature on the .msp downloaded in the UK shows an error of HashMismatch:

"The contents of file C:\Users\AdamCook\Downloads\AcrobatDCx64Upd2300620380.msp might have
been changed by an unauthorized user or process, because the hash of the file does not match
the hash stored in the digital signature. The script cannot run on the specified system. For
more information, run Get-Help about_Signing."

We believe there is a caching issue on Adobe's CDN which has not correctly replicated the correct AcrobatDCx64Upd2300620380.msp. Kindly fix the issue with the CDN, or whatever the issue is causing an .msp with invalid digital signature in some regions of the world.

[Meenakshi Negi]

Hi Patch My PC,

Thank you for reaching out, and sorry about the delayed response.

We will share the information with the team to get this checked. Could you please confirm from which page you are using the download link?

We will update you once we get more information from the team. 

Thanks,

Meenakshi

[Patch My PC]

From your website: Acrobat Enterprise Release Notes — Acrobat-Acrobat Reader Release Notes (adobe.com)

[Patch My PC]

We're seeing the exact same issue again for 23.008.20555. 

[Patch My PC]

We're seeing the exact same issue again for 24.002.20759. Is Adobe doing anything to understand root cause?

[Maxime37585025z46i]

Hi MeenakshiNegi,

Can we have an update on this topic please ?

Thanks

Maxime

[Patch My PC]

I'm reporting the same issue again as described here: Re: Invalid digital signature on AcrobatDCx64Upd23... - Adobe Community - 14246103

Some parts of the world are reporting different hashes for AcrobatDCx64Upd2300820555.msp. This file is downloaded using the following URL: https://ardownload2.adobe.com/pub/adobe/acrobat/win/AcrobatDC/2300820555/AcrobatDCx64Upd2300820555.m...

Much like the other linked reported problem, the digital signature on the file itself is invalid.

We believe there is a caching issue on Adobe's CDN which has not correctly replicated the correct AcrobatDCx64Upd2300820555.msp. Kindly fix the issue with the CDN, or whatever the issue is causing an .msp with invalid digital signature in some regions of the world.

[Abambo]

Why aren't you updating your post there? And why are you selecting all available topics instead of only the relevant one? Some experts are following selected topics. That's why there are topics.

I will merge this with your original post.

[Nick37658038ny2x]

This is a ridiculous situation.  Please give this more attention Adobe!  We are trying to do the right thing and patch systems and check the SHA256 value, yet you are releasing with incorrect information.