CVE-2009-1358

Published Apr 21, 2009 CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Description
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-1779-1 New apt packages fix several vulnerabilities
EUVD EUVD EUVD-2009-1356 apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 5:13 AM
Reserved
Apr 21, 2009, 12:00 AM
Status
Modified
Published
Apr 21, 2009, 11:30 PM
Modified
Jun 16, 2026, 11:07 PM