Jann Horn discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-doc" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-transport-https" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-transport-https-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-utils" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "apt-utils-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-inst1.5" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-inst1.5-dbgsym" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg-dev" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg-doc" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg4.12" }, { "binary_version": "1.0.1ubuntu2.17", "binary_name": "libapt-pkg4.12-dbgsym" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-doc" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-transport-https" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-transport-https-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-utils" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "apt-utils-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-inst2.0" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-inst2.0-dbgsym" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg-dev" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg-doc" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg5.0" }, { "binary_version": "1.2.15ubuntu0.2", "binary_name": "libapt-pkg5.0-dbgsym" } ] }