CVE-2018-0501 The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, a...
MediumCVSS 5.9
EPSS 0.95%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apt(Debian:12) | < 1.6.4 | 1.6.4 |
| debian/apt(Debian:13) | < 1.6.4 | 1.6.4 |
| debian/apt(Debian:14) | < 1.6.4 | 1.6.4 |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian advanced package tool | >= 1.6.0, < 1.6.4 | 1.6.4 |
| debian advanced package tool | = 1.7.0-alpha | No fix listed |
| debian advanced package tool | = 1.7.0-alpha1 | No fix listed |
| debian advanced package tool | = 1.7.0-alpha2 | No fix listed |
References
- Debian Security Tracker CVE-2018-0501 vendor-advisory
- mirror.fail third-party-advisory url-repurposed
- salsa.debian.org patch third-party-advisory
- salsa.debian.org patch third-party-advisory
- USN-3746-1 third-party-advisory vendor-advisory