CVE-2007-4739

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2007-4739

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2007-4739.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2007-4739

Published

2007-09-06T19:17:00Z

Modified

2025-04-09T00:30:58Z

Downstream

DSA-1394-1

Summary

[none]

Details

reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.

References

Affected packages

Debian:11 / reprepro

Package

Name: reprepro
Purl: pkg:deb/debian/reprepro?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.4-1

Ecosystem specific

{
    "urgency": "high"
}

Debian:12 / reprepro

Package

Name: reprepro
Purl: pkg:deb/debian/reprepro?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.4-1

Ecosystem specific

{
    "urgency": "high"
}

Debian:13 / reprepro

Package

Name: reprepro
Purl: pkg:deb/debian/reprepro?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.4-1

Ecosystem specific

{
    "urgency": "high"
}