NetSight
IP …
critical10.0

CVE-2009-1358

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed …

Impact

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

Affected products

VendorProductAffected versions
DebianAdvanced Package Tool
through 0.7.20
Versions 0.7.0, 0.7.1, 0.7.2, 0.7.2-0.1, 0.7.10
DebianApt
Versions 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6

References