PT-2018-8863 · Debian+1 · Apt+1

David Kalnischkies · Published 2018-08-20 · Updated 2024-02-14 · CVE-2018-0501

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advanced Package Tool (APT) versions 1.6.x through 1.6.3 Advanced Package Tool (APT) versions 1.7.x through 1.7.0~alpha2

Description The issue concerns the mirror:// method implementation in APT, which mishandles gpg signature verification for the InRelease file of a fallback mirror.

Recommendations For versions 1.6.x through 1.6.3, update to version 1.6.4 or later. For versions 1.7.x through 1.7.0alpha2, update to version 1.7.0alpha3 or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2018-0501

USN-3746-1

Affected Products

Apt

Ubuntu

References · 13

• https://cve.org/CVERecord?id=CVE-2018-0501 · Security Note
• https://ubuntu.com/security/CVE-2018-0501 · Vendor Advisory
• https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47 · Patch
• https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-0501 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3746-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-0501 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3746-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0501 · Vendor Advisory
• https://usn.ubuntu.com/3746-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0501 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-0501 · Vendor Advisory
• https://mirror.fail · Note