NVD

Id
48644  
Name
CVE-2009-1358  
Description
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-04-21  
Modified Date
2009-05-19  
Seq
2009-1358  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
245533 48644 CVE-2009-1358 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091  View
245534 48644 CVE-2009-1358 DSA-1779  View
245535 48644 CVE-2009-1358 34630  View
245536 48644 CVE-2009-1358 USN-762-1  View
245537 48644 CVE-2009-1358 apt-aptget-gpgv-security-bypass(50086)  View
245538 48644 CVE-2009-1358 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
54363 JVNDB-2007-003055 apt の apt-get における悪意のあるリポジトリをインストールされる脆弱性 apt の apt-get には、gpgv から正しいエラーコードをチェックしないため、失効または期限切れの鍵で署名されているレポジトリを有効とみなし、apt に悪意のあるリポジトリをインストールされる脆弱性が存在します。 CVE-2009-1358 38789 CVE-2009-1358 48644 10 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-003055.html 2007-07-14 2012-06-26 View