Описание
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Отчет
PackageKit as shipped with Red Hat Enterprise Linux 6, 7, and 8 is not affected by this flaw because it uses a different backend, and the flaw is specific to the aptcc backend used for debian-based systems.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | PackageKit | Not affected | ||
| Red Hat Enterprise Linux 7 | PackageKit | Not affected | ||
| Red Hat Enterprise Linux 8 | PackageKit | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
PackageKit's apt backend mistakenly treated all local debs as trusted. ...
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Уязвимость пакетного менеджера PackageKit, связанная с ошибками управления привилегиями, позволяющая нарушителю оказать воздействие на целостность данных
EPSS
4.7 Medium
CVSS3