| Name | CVE-2007-4739 |
| Description | reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-1394-1 |
| Debian Bugs | 440535 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| reprepro (PTS) | bullseye | 5.3.0-1.2 | fixed |
| bookworm | 5.3.1-1+deb12u2 | fixed |
| sid, trixie | 5.4.6-2 | fixed |
The information below is based on the following data on fixed versions.
Notes
patch for etch in the BTS
[sarge] - reprepro <not-affected> (Vulnerable code introduced in 1.3.0)