CVE-2009-1358

2009-04-2123:30:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.023

Percentile

89.7%

JSON

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

OSVersionArchitecturePackageVersionFilename
Debian12allapt< 0.7.21apt_0.7.21_all.deb
Debian11allapt< 0.7.21apt_0.7.21_all.deb
Debian999allapt< 0.7.21apt_0.7.21_all.deb
Debian13allapt< 0.7.21apt_0.7.21_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	apt	< 0.7.21	apt_0.7.21_all.deb
Debian	11	all	apt	< 0.7.21	apt_0.7.21_all.deb
Debian	999	all	apt	< 0.7.21	apt_0.7.21_all.deb
Debian	13	all	apt	< 0.7.21	apt_0.7.21_all.deb