CVE-2007-4739 reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing i...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian reprepro | = 1.3.0 | No fix listed |
| debian reprepro | = 1.3.1 | No fix listed |
| debian reprepro | = 2.0.0 | No fix listed |
| debian reprepro | = 2.1.0 | No fix listed |
| debian reprepro | = 2.2.0 | No fix listed |
| debian reprepro | = 2.2.1 | No fix listed |
| debian reprepro | = 2.2.2 | No fix listed |
| debian reprepro | = 2.2.3 | No fix listed |
| debian reprepro(Debian:12) | < 2.2.4-1 | 2.2.4-1 |
| debian reprepro(Debian:13) | < 2.2.4-1 | 2.2.4-1 |
| debian reprepro(Debian:14) | < 2.2.4-1 | 2.2.4-1 |
References
- alioth.debian.org patch
- bugs.debian.org patch
- bugs.debian.org
- 40172 vdb-entry
- 26678 patch third-party-advisory vendor-advisory
- 27334 third-party-advisory
- DSA-1394 vendor-advisory
- 25537 vdb-entry
- Debian Security Tracker CVE-2007-4739 vendor-advisory
- bugs.debian.org issue-tracking