Description
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 0.7.25 | — |
| Debian 13 | apt | 0.7.25 | — |
| Debian 12 | apt | 0.7.25 | — |
References
- 20120614 Using second gpg keyring may be misleading? mailing-list
- 54046 vdb-entry
- 20120612 Strange gpg key shadowing mailing-list
- USN-1477-1 vendor-advisory
- USN-1475-1 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639
- 20120615 ubuntu apt-key (part 3) mailing-list
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681