Description
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/58843
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59358
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2014/dsa-2958
Exploit x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2246-1
Scores
EPSS
0.0157
EPSS Percentile
72.5%
Details
CWE
CWE-20
Status
published
Products (1)
debian/advanced_package_tool
< 1.0.3
Published
Jun 17, 2014
Tracked Since
Feb 18, 2026