| Package | Affected versions | Patched versions |
|---|---|---|
| advanced package tool | = 0.7.0= 0.7.1= 0.7.10= 0.7.11= 0.7.12= 0.7.13= 0.7.14= 0.7.15= 0.7.16= 0.7.17= 0.7.18= 0.7.19= 0.7.2= 0.7.2-0.1= 0.7.20= 0.7.20.1= 0.7.20.2= 0.7.21= 0.7.22= 0.7.22.1= 0.7.22.2= 0.7.23= 0.7.23.1= 0.7.24= 0.8.0= 0.8.1= 0.8.10= 0.8.10.1= 0.8.10.2= 0.8.10.3= 0.8.11= 0.8.11.1= 0.8.11.2= 0.8.11.3= 0.8.11.4= 0.8.11.5= 0.8.12= 0.8.13= 0.8.13.1= 0.8.13.2= 0.8.14= 0.8.14.1= 0.8.15= 0.8.15.1= 0.8.15.10= 0.8.15.6= 0.8.15.7= 0.8.15.8= 0.8.15.9 |
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free