CVE-2009-1358 | BDVDB-2026-36256 Detail
Description#
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://secunia.com/advisories/34874
- http://www.debian.org/security/2009/dsa-1779
- http://secunia.com/advisories/34829
- http://www.securityfocus.com/bid/34630
- http://secunia.com/advisories/34832
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012
- https://usn.ubuntu.com/762-1/
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50086
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.