CVE-2015-1337

Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.

Score

CVSS 2.0 6.8 Medium

Status

Modified - security@ubuntu.com

Published

2015-10-09

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Ubuntu Linux (Canonical)
• Simplestreams (Simpestreams Project)

References

• http://www.ubuntu.com/usn/USN-2746-1
• http://www.ubuntu.com/usn/USN-2746-2
• https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004