CVE-2018-0501

Опубликовано: 21 авг. 2018

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.

Ссылки

https://mirror.fail
Third Party Advisory
URL Repurposed
https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec
Patch
Third Party Advisory
https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47
Patch
Third Party Advisory
https://usn.ubuntu.com/3746-1/
Third Party Advisory
https://mirror.fail
Third Party Advisory
URL Repurposed
https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec
Patch
Third Party Advisory
https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47
Patch
Third Party Advisory
https://usn.ubuntu.com/3746-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:*

Версия от 1.6.0 (включая) до 1.6.4 (исключая)

cpe:2.3:a:debian:advanced_package_tool:1.7.0:alpha:*:*:*:*:*:*

cpe:2.3:a:debian:advanced_package_tool:1.7.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:debian:advanced_package_tool:1.7.0:alpha2:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00132

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-347

Связанные уязвимости

CVE-2018-0501

CVSS3: 5.9

ubuntu

больше 7 лет назад

CVE-2018-0501

CVSS3: 5.9

debian

больше 7 лет назад

The mirror:// method implementation in Advanced Package Tool (APT) 1.6 ...

GHSA-h75r-32pp-3c7j

CVSS3: 5.9

github

больше 3 лет назад

EPSS

Процентиль: 33%

0.00132

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-347