PT-2018-8863 · Debian+1 · Apt+1

David Kalnischkies · Publicado 2018-08-20 · Atualizado 2024-02-14 · CVE-2018-0501

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advanced Package Tool (APT) versions 1.6.x through 1.6.3 Advanced Package Tool (APT) versions 1.7.x through 1.7.0~alpha2

Description The issue concerns the mirror:// method implementation in APT, which mishandles gpg signature verification for the InRelease file of a fallback mirror.

Recommendations For versions 1.6.x through 1.6.3, update to version 1.6.4 or later. For versions 1.7.x through 1.7.0alpha2, update to version 1.7.0alpha3 or later.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2018-0501

USN-3746-1

Produtos afetados

Apt

Ubuntu

Referências · 13

• https://cve.org/CVERecord?id=CVE-2018-0501 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-0501 · Aviso do Fabricante
• https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47 · Correção
• https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-0501 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3746-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-0501 · Aviso do Fabricante
• https://mirror.fail · Nota
• https://osv.dev/vulnerability/USN-3746-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0501 · Aviso do Fabricante
• https://usn.ubuntu.com/3746-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0501 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-0501 · Aviso do Fabricante