CVE-2013-1051

2013-03-1400:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

32.4%

JSON

apt 0.8.16, 0.9.7, and possibly other versions does not properly handle
InRelease files, which allows man-in-the-middle attackers to modify
packages before installation via unknown vectors, possibly related to
integrity checking and the use of third-party repositories.

Notes

Author	Note
mdeslaur	only oneiric+ support InRelease files

OSVersionArchitecturePackageVersionFilename
ubuntu11.10noarchapt< 0.8.16~exp5ubuntu13.7UNKNOWN
ubuntu12.04noarchapt< 0.8.16~exp12ubuntu10.10UNKNOWN
ubuntu12.10noarchapt< 0.9.7.5ubuntu5.4UNKNOWN