CVE-2012-0214

Name	CVE-2012-0214
Description	The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apt (PTS)	buster	1.8.2.3	fixed
	buster (security)	1.8.2.2	fixed
	bullseye	2.2.4	fixed
	bookworm	2.6.1	fixed
	sid, trixie	2.9.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
apt	source	lenny	(not affected)
apt	source	squeeze	(not affected)
apt	source	(unstable)	0.8.15.10

[squeeze] - apt <not-affected> (Vulnerable code not present)
[lenny] - apt <not-affected> (Vulnerable code not present)