Vulnerability Details : CVE-2011-1829
APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.
Vulnerability category: Input validation
Products affected by CVE-2011-1829
- cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
Threat overview for CVE-2011-1829
Top countries where our scanners detected CVE-2011-1829
Top open port discovered on systems with this issue
80
IPs affected by CVE-2011-1829 9
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2011-1829!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2011-1829
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-1829
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2011-1829
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1829
-
http://launchpadlibrarian.net/75126628/apt_0.8.13.2ubuntu2_0.8.13.2ubuntu4.1.diff.gz
Patch;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-1169-1
USN-1169-1: APT vulnerability | Ubuntu security noticesThird Party Advisory
-
http://www.securityfocus.com/bid/48671
apt Repository Inline GPG Signature Verification VulnerabilityThird Party Advisory;VDB Entry
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/68560
Debian Apt GPG security bypass CVE-2011-1829 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://packages.debian.org/changelogs/pool/main/a/apt/current/changelog
Release Notes;Vendor Advisory
-
https://launchpad.net/bugs/784473
Bug #784473 “Treats partial InRelease signature as verifying the...” : Bugs : apt package : UbuntuThird Party Advisory
-
https://launchpad.net/ubuntu/+archive/primary/+sourcepub/1817196/+listing-archive-extra
Patch
Jump to