CVE-2014-0478

2014-06-1200:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:P/A:P

EPSS

0.001

Percentile

44.3%

JSON

APT before 1.0.4 does not properly validate source packages, which allows
man-in-the-middle attackers to download and install Trojan horse packages
by removing the Release signature.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchapt< 0.7.25.3ubuntu9.15UNKNOWN
ubuntu12.04noarchapt< 0.8.16~exp12ubuntu10.17UNKNOWN
ubuntu13.10noarchapt< 0.9.9.1~ubuntu3.2UNKNOWN
ubuntu14.04noarchapt< 1.0.1ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	apt	< 0.7.25.3ubuntu9.15	UNKNOWN
ubuntu	12.04	noarch	apt	< 0.8.16~exp12ubuntu10.17	UNKNOWN
ubuntu	13.10	noarch	apt	< 0.9.9.1~ubuntu3.2	UNKNOWN
ubuntu	14.04	noarch	apt	< 1.0.1ubuntu2.1	UNKNOWN