VulnerabilityModified

CVE-2011-1829

APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.

MEDIUM 4.3EPSS 1.69%

Does this matter?

Lower severity and a low EPSS score (1.69%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 1.69% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: debian/advanced package tool · canonical/ubuntu linux
Source: security@ubuntu.com

References

http://launchpadlibrarian.net/75126628/apt_0.8.13.2ubuntu2_0.8.13.2ubuntu4.1.diff.gzPatch, Third Party Advisory
http://packages.debian.org/changelogs/pool/main/a/apt/current/changelogRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/48671Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1169-1Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68560Third Party Advisory, VDB Entry
https://launchpad.net/bugs/784473Third Party Advisory
https://launchpad.net/ubuntu/+archive/primary/+sourcepub/1817196/+listing-archive-extraPatch
http://launchpadlibrarian.net/75126628/apt_0.8.13.2ubuntu2_0.8.13.2ubuntu4.1.diff.gzPatch, Third Party Advisory
http://packages.debian.org/changelogs/pool/main/a/apt/current/changelogRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/48671Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1169-1Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68560Third Party Advisory, VDB Entry
https://launchpad.net/bugs/784473Third Party Advisory
https://launchpad.net/ubuntu/+archive/primary/+sourcepub/1817196/+listing-archive-extraPatch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.