CVE-2009-1358

7 documents7 sources
Severity
10.0CRITICAL
EPSS
1.4%
top 19.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Advanced Package ToolDebian APT
Timeline
PublishedApr 21
Latest updateMay 2

Description

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages3 packages

▶Debianapt< 0.7.21+3
▶NVDdebian/apt147 versions+146

🔴Vulnerability Details

3
GHSA
GHSA-ggxf-mg5q-59fp: apt-get in apt before 0↗2022-05-02
▶
OSV
CVE-2009-1358: apt-get in apt before 0↗2009-04-21
▶
CVEList
CVE-2009-1358: apt-get in apt before 0↗2009-04-21
▶

📋Vendor Advisories

2
Debian
CVE-2009-1358: apt - apt-get in apt before 0.7.21 does not check for the correct error code from gpgv...↗2009
▶
Red Hat
apt: incorrect gpg exit status checking when verifying repository signature↗
▶

💬Community

1
Bugzilla
CVE-2009-1358 apt: incorrect gpg exit status checking when verifying repository signature↗2009-04-22
▶
CVE-2009-1358 (CRITICAL CVSS 10) | apt-get in apt before 0.7.21 does n | cvebase.io