Code injection

2009-04-2123:30:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.023 Low

EPSS

Percentile

89.3%

JSON

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

CPENameOperatorVersion
advanced_package_tooleq0.7.0
advanced_package_tooleq0.7.1
advanced_package_tooleq0.7.2
advanced_package_tooleq0.7.2-0.1
advanced_package_tooleq0.7.10
advanced_package_tooleq0.7.11
advanced_package_tooleq0.7.12
advanced_package_tooleq0.7.13
advanced_package_tooleq0.7.14
advanced_package_tooleq0.7.15 exp1

Name	Operator	Version
advanced_package_tool	eq	0.7.0
advanced_package_tool	eq	0.7.1
advanced_package_tool	eq	0.7.2
advanced_package_tool	eq	0.7.2-0.1
advanced_package_tool	eq	0.7.10
advanced_package_tool	eq	0.7.11
advanced_package_tool	eq	0.7.12
advanced_package_tool	eq	0.7.13
advanced_package_tool	eq	0.7.14
advanced_package_tool	eq	0.7.15 exp1