Description
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 0.7.21 | — |
| Debian 13 | apt | 0.7.21 | — |
| Debian 12 | apt | 0.7.21 | — |
| Debian 6.0 | apt | 0.7.20.2+squeeze1 | DTSA-199-1 |
| Debian 5.0 | apt | 0.7.20.2+lenny1 | DSA-1779-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | apt | 0.6.46.4-0.1+etch1 | DSA-1779-1 |
Advisories 2
- DSA-1779-1 apt - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-199-1 apt - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34874 third-party-advisory
- DSA-1779 vendor-advisory
- 34829 third-party-advisory
- 34630 vdb-entry
- 34832 third-party-advisory
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012
- USN-762-1 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091
- apt-aptget-gpgv-security-bypass(50086) vdb-entry