Summary
Jakub Wilk discovered that APT did not correctly validate signatures when
downloading source packages. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to install
altered source packages.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | apt | 1.0.1ubuntu2.1 |
Vulnerabilities 1
-
Unscored —
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and i…
References
-
report
https://ubuntu.com/security/CVE-2014-0478