CVE-2007-4739

Name	CVE-2007-4739
Description	reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-1394-1
Debian Bugs	440535

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
reprepro (PTS)	buster	5.3.0-1	fixed
	bullseye	5.3.0-1.2	fixed
	bookworm, sid	5.3.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
reprepro	source	sarge	(not affected)
reprepro	source	etch	1.3.1+1-1		DSA-1394-1
reprepro	source	(unstable)	2.2.4-1	high		440535

patch for etch in the BTS
[sarge] - reprepro <not-affected> (Vulnerable code introduced in 1.3.0)