Description
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 0.7.25 | — |
| Debian 13 | apt | 0.7.25 | — |
| Debian 12 | apt | 0.7.25 | — |
References
- 20120612 Strange gpg key shadowing mailing-list
- USN-1477-1 vendor-advisory
- USN-1475-1 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128