← Back

CVE-2018-0501

nvd nist
Published: Aug 21, 2018Modified: Nov 21, 2024

JSON object

Loading...
5.9
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.

Affected (5)

Canonical
1 product
Ubuntu Linux
Debian
1 product
Advanced Package Tool
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ubuntu Linux
Version 18.04
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Advanced Package Tool
From 1.6.0 to 1.6.4
Advanced Package Tool
Version 1.7.0 alpha1
Advanced Package Tool
Version 1.7.0 alpha2
Advanced Package Tool
Version 1.7.0 alpha

Related CWEs

CWE-347
Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (8)

Source: security@debian.org
Third Party AdvisoryURL Repurposed
Source: security@debian.org
PatchThird Party Advisory
Source: security@debian.org
PatchThird Party Advisory
Source: security@debian.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryURL Repurposed
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.