EUVD-2018-1323

Malware in sbrugna...

Design/Logic Flaw

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The CVE-2018-0501 detail: APT’s mirror:// handling in 1.6.x (pre-1.6.4) and 1.7.x (pre-1.7.0~alpha3) mishandles GPG verification for the InRelease file of a fallback mirror (mirrorfail). Impact: remote MITM could install altered packages when using mirror:// entries. Remediation: upgrade to 1.6.4...