CVEvulnerability
CVE-2012-0214
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-04-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.
Affected configurations
• advanced package tool advanced package tool (<= 0.8.16\~exp12)
• advanced package tool advanced package tool 0.8.11
• advanced package tool advanced package tool 0.8.12
• advanced package tool advanced package tool 0.8.13
• advanced package tool advanced package tool 0.8.14
• advanced package tool advanced package tool 0.8.15
Related
Weakness · not in database (1)
References
- http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92 anonscm.debian.org
- http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 anonscm.debian.org
- http://www.ubuntu.com/usn/USN-1385-1 www.ubuntu.com
- http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92 anonscm.debian.org
- http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 anonscm.debian.org
- http://www.ubuntu.com/usn/USN-1385-1 www.ubuntu.com