The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-doc" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-transport-https" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-transport-https-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-utils" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-utils-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-inst1.5" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-inst1.5-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg-dev" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg-doc" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg4.12" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg4.12-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-doc" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-transport-https" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-transport-https-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-utils" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-utils-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-inst2.0" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-inst2.0-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg-dev" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg-doc" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg5.0" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg5.0-dbgsym" } ] }