CVE-2007-4739: Medium severity Debian Reprepro vulnerability
Published Sep 6, 2007
·Updated
reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.
Affected Software
8 affected components
Debian Reprepro=2.2.0
Debian Reprepro=2.2.3
Debian Reprepro=1.3.0
Debian Reprepro=2.1.0
Debian Reprepro=1.3.1
Debian Reprepro=2.2.1
Debian Reprepro=2.2.2
Debian Reprepro=2.0.0
Remediation
Patch Available
Patch Available
Patch Available
Event History
Sep 6, 2007
CVE Published
07:17 PM
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-4739?
CVE-2007-4739 is classified as high severity due to its potential to allow unauthorized updates to repositories.
2
How do I fix CVE-2007-4739?
To fix CVE-2007-4739, upgrade to a version of reprepro that is higher than 2.2.3.
3
Which versions of reprepro are affected by CVE-2007-4739?
CVE-2007-4739 affects reprepro versions 1.3.0 through 2.2.3.
4
Can CVE-2007-4739 lead to data integrity issues?
Yes, CVE-2007-4739 can lead to data integrity issues by allowing attackers to create and distribute fraudulent Release.gpg files.
5
Is there a patch available for CVE-2007-4739?
There is no standalone patch for CVE-2007-4739; the vulnerability is resolved through software upgrades.