CVE-2009-1358

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

• debian advanced package tool (<= 0.7.20) • debian advanced package tool 0.7.0 • debian advanced package tool 0.7.1 • debian advanced package tool 0.7.2 • debian advanced package tool 0.7.2-0.1 • debian advanced package tool 0.7.10 • debian advanced package tool 0.7.11 • debian advanced package tool 0.7.12 • debian advanced package tool 0.7.13 • debian advanced package tool 0.7.14 • debian advanced package tool 0.7.15 • debian advanced package tool 0.7.16 • debian advanced package tool 0.7.17 • debian advanced package tool 0.7.18 • debian advanced package tool 0.7.19 • debian advanced package tool 0.7.20.1 • debian advanced package tool 0.7.20.2 • debian advanced package tool 0.7.21 • debian apt 0.0.1 • debian apt 0.0.2 • debian apt 0.0.3 • debian apt 0.0.4 • debian apt 0.0.5 • debian apt 0.0.6 • debian apt 0.0.7 • debian apt 0.0.8 • debian apt 0.0.9 • debian apt 0.0.10 • debian apt 0.0.11 • debian apt 0.0.12 • debian apt 0.0.13 • debian apt 0.0.13-bo1 • debian apt 0.0.14 • debian apt 0.0.15 • debian apt 0.0.15-0.1bo • debian apt 0.0.15-0.2bo • debian apt 0.0.16-1 • debian apt 0.0.17-1 • debian apt 0.1 • debian apt 0.1.1 • debian apt 0.1.3 • debian apt 0.1.5 • debian apt 0.1.6 • debian apt 0.1.7 • debian apt 0.1.9 • debian apt 0.3.0 • debian apt 0.3.1 • debian apt 0.3.2 • debian apt 0.3.3 • debian apt 0.3.4 • debian apt 0.3.6 • debian apt 0.3.7 • debian apt 0.3.9 • debian apt 0.3.11 • debian apt 0.3.12 • debian apt 0.3.13 • debian apt 0.3.14 • debian apt 0.3.15 • debian apt 0.3.16 • debian apt 0.3.17 … and 105 more