Summary
Max Justicz discovered that APT incorrectly handled certain parameters
during redirects. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to install
altered packages.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | apt | 1.0.1ubuntu2.19 |
| Ubuntu · 16.04 LTS 16.04:LTS | apt | 1.2.29ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | apt | 1.6.6ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to c…
References
-
report
https://ubuntu.com/security/CVE-2019-3462