PT-2011-3399 · Debian · Apt

Publicado 2011-07-27 · Atualizado 2021-03-25 · CVE-2011-1829

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions APT versions prior to 0.8.15.2

Description The issue arises from the lack of proper validation of inline GPG signatures, allowing man-in-the-middle attackers to install modified packages. This can occur through vectors involving the lack of an initial clearsigned message.

Recommendations For versions prior to 0.8.15.2, update to version 0.8.15.2 or later to resolve the issue. As a temporary workaround, consider restricting package installations to trusted sources and verifying the integrity of packages through alternative means until the update can be applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1829

Produtos afetados

Apt

Referências · 11

• https://osv.dev/vulnerability/CVE-2011-1829 · Aviso do Fabricante
• http://packages.debian.org/changelogs/pool/main/a/apt/current/changelog · Aviso do Fabricante
• http://launchpadlibrarian.net/75126628/apt_0.8.13.2ubuntu2_0.8.13.2ubuntu4.1.diff.gz · Correção
• https://launchpad.net/ubuntu/+archive/primary/+sourcepub/1817196/+listing-archive-extra · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1829 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1829 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68560 · Nota
• https://launchpad.net/bugs/784473 · Nota
• http://ubuntu.com/usn/USN-1169-1 · Aviso do Fabricante
• http://securityfocus.com/bid/48671 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1829 · Aviso do Fabricante