CVE-2013-1051

apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.

Score

CVSS 2.0 4.3 Medium

Status

Modified - security@ubuntu.com

Published

2013-03-21

Last modified

2024-09-17

Weaknesses

CWE-20

Affected products

• Ubuntu Linux (Canonical)
• Advanced Package Tool (Debian)
• Apt (Debian)

References

• http://osvdb.org/91428
• http://secunia.com/advisories/52633
• http://www.ubuntu.com/usn/USN-1762-1