PT-2018-8863 · Debian+1 · Apt+1
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Advanced Package Tool (APT) versions 1.6.x through 1.6.3
Advanced Package Tool (APT) versions 1.7.x through 1.7.0~alpha2
Description
The issue concerns the mirror:// method implementation in APT, which mishandles gpg signature verification for the InRelease file of a fallback mirror.
Recommendations
For versions 1.6.x through 1.6.3, update to version 1.6.4 or later.
For versions 1.7.x through 1.7.0alpha2, update to version 1.7.0alpha3 or later.
Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apt
Ubuntu