DescriptionThe pkgAcqMetaClearSig::Failed method in apt-pkg/ in Advanced Package Tool (APT) 0.8.11 through and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apt (PTS)wheezy0.9.7.9+deb7u7fixed
wheezy (security)
jessie (security), jessie1.
buster, sid1.6~beta1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
aptsourcelenny(not affected)
aptsourcesqueeze(not affected)


[squeeze] - apt <not-affected> (Vulnerable code not present)
[lenny] - apt <not-affected> (Vulnerable code not present)

Search for package or bug name: Reporting problems