VulnerabilityModified
CVE-2015-1337
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
MEDIUM 6.8EPSS 1.71%
Does this matter?
Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.
Description
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- simpestreams project/simplestreams · canonical/ubuntu linux
- Source
- security@ubuntu.com
References
- http://www.ubuntu.com/usn/USN-2746-1
- http://www.ubuntu.com/usn/USN-2746-2
- https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004Exploit
- http://www.ubuntu.com/usn/USN-2746-1
- http://www.ubuntu.com/usn/USN-2746-2
- https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.