CVE-2009-1358
First published: Tue Apr 21 2009(Updated: )
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Debian APT Package Management | <=0.7.20 | |
| Debian APT Package Management | =0.7.0 | |
| Debian APT Package Management | =0.7.1 | |
| Debian APT Package Management | =0.7.2 | |
| Debian APT Package Management | =0.7.2-0.1 | |
| Debian APT Package Management | =0.7.10 | |
| Debian APT Package Management | =0.7.11 | |
| Debian APT Package Management | =0.7.12 | |
| Debian APT Package Management | =0.7.13 | |
| Debian APT Package Management | =0.7.14 | |
| Debian APT Package Management | =0.7.15 | |
| Debian APT Package Management | =0.7.15-exp1 | |
| Debian APT Package Management | =0.7.15-exp2 | |
| Debian APT Package Management | =0.7.15-exp3 | |
| Debian APT Package Management | =0.7.16 | |
| Debian APT Package Management | =0.7.17 | |
| Debian APT Package Management | =0.7.17-exp1 | |
| Debian APT Package Management | =0.7.17-exp2 | |
| Debian APT Package Management | =0.7.17-exp3 | |
| Debian APT Package Management | =0.7.17-exp4 | |
| Debian APT Package Management | =0.7.18 | |
| Debian APT Package Management | =0.7.19 | |
| Debian APT Package Management | =0.7.20.1 | |
| Debian APT Package Management | =0.7.20.2 | |
| Debian APT Package Management | =0.7.21 | |
| Debian APT Package Management | =0.0.1 | |
| Debian APT Package Management | =0.0.2 | |
| Debian APT Package Management | =0.0.3 | |
| Debian APT Package Management | =0.0.4 | |
| Debian APT Package Management | =0.0.5 | |
| Debian APT Package Management | =0.0.6 | |
| Debian APT Package Management | =0.0.7 | |
| Debian APT Package Management | =0.0.8 | |
| Debian APT Package Management | =0.0.9 | |
| Debian APT Package Management | =0.0.10 | |
| Debian APT Package Management | =0.0.11 | |
| Debian APT Package Management | =0.0.12 | |
| Debian APT Package Management | =0.0.13 | |
| Debian APT Package Management | =0.0.13-bo1 | |
| Debian APT Package Management | =0.0.14 | |
| Debian APT Package Management | =0.0.15 | |
| Debian APT Package Management | =0.0.15-0.1bo | |
| Debian APT Package Management | =0.0.15-0.2bo | |
| Debian APT Package Management | =0.0.16-1 | |
| Debian APT Package Management | =0.0.17-1 | |
| Debian APT Package Management | =0.1 | |
| Debian APT Package Management | =0.1.1 | |
| Debian APT Package Management | =0.1.3 | |
| Debian APT Package Management | =0.1.5 | |
| Debian APT Package Management | =0.1.6 | |
| Debian APT Package Management | =0.1.7 | |
| Debian APT Package Management | =0.1.9 | |
| Debian APT Package Management | =0.3.0 | |
| Debian APT Package Management | =0.3.1 | |
| Debian APT Package Management | =0.3.2 | |
| Debian APT Package Management | =0.3.3 | |
| Debian APT Package Management | =0.3.4 | |
| Debian APT Package Management | =0.3.6 | |
| Debian APT Package Management | =0.3.7 | |
| Debian APT Package Management | =0.3.9 | |
| Debian APT Package Management | =0.3.11 | |
| Debian APT Package Management | =0.3.12 | |
| Debian APT Package Management | =0.3.13 | |
| Debian APT Package Management | =0.3.14 | |
| Debian APT Package Management | =0.3.15 | |
| Debian APT Package Management | =0.3.16 | |
| Debian APT Package Management | =0.3.17 | |
| Debian APT Package Management | =0.3.18 | |
| Debian APT Package Management | =0.3.19 | |
| Debian APT Package Management | =0.5.0 | |
| Debian APT Package Management | =0.5.1 | |
| Debian APT Package Management | =0.5.2 | |
| Debian APT Package Management | =0.5.3 | |
| Debian APT Package Management | =0.5.4 | |
| Debian APT Package Management | =0.5.5 | |
| Debian APT Package Management | =0.5.5.1 | |
| Debian APT Package Management | =0.5.6 | |
| Debian APT Package Management | =0.5.7 | |
| Debian APT Package Management | =0.5.8 | |
| Debian APT Package Management | =0.5.9 | |
| Debian APT Package Management | =0.5.10 | |
| Debian APT Package Management | =0.5.11 | |
| Debian APT Package Management | =0.5.12 | |
| Debian APT Package Management | =0.5.13 | |
| Debian APT Package Management | =0.5.14 | |
| Debian APT Package Management | =0.5.15 | |
| Debian APT Package Management | =0.5.16 | |
| Debian APT Package Management | =0.5.17 | |
| Debian APT Package Management | =0.5.18 | |
| Debian APT Package Management | =0.5.19 | |
| Debian APT Package Management | =0.5.20 | |
| Debian APT Package Management | =0.5.21 | |
| Debian APT Package Management | =0.5.22 | |
| Debian APT Package Management | =0.5.23 | |
| Debian APT Package Management | =0.5.24 | |
| Debian APT Package Management | =0.5.25 | |
| Debian APT Package Management | =0.5.26 | |
| Debian APT Package Management | =0.5.27 | |
| Debian APT Package Management | =0.5.28 | |
| Debian APT Package Management | =0.5.29 | |
| Debian APT Package Management | =0.5.30 | |
| Debian APT Package Management | =0.5.30-ubuntu1 | |
| Debian APT Package Management | =0.5.30-ubuntu2 | |
| Debian APT Package Management | =0.5.31 | |
| Debian APT Package Management | =0.5.32 | |
| Debian APT Package Management | =0.6.0 | |
| Debian APT Package Management | =0.6.1 | |
| Debian APT Package Management | =0.6.2 | |
| Debian APT Package Management | =0.6.3 | |
| Debian APT Package Management | =0.6.4 | |
| Debian APT Package Management | =0.6.5 | |
| Debian APT Package Management | =0.6.6 | |
| Debian APT Package Management | =0.6.7 | |
| Debian APT Package Management | =0.6.8 | |
| Debian APT Package Management | =0.6.9 | |
| Debian APT Package Management | =0.6.10 | |
| Debian APT Package Management | =0.6.11 | |
| Debian APT Package Management | =0.6.12 | |
| Debian APT Package Management | =0.6.13 | |
| Debian APT Package Management | =0.6.14 | |
| Debian APT Package Management | =0.6.15 | |
| Debian APT Package Management | =0.6.16 | |
| Debian APT Package Management | =0.6.17 | |
| Debian APT Package Management | =0.6.18 | |
| Debian APT Package Management | =0.6.19 | |
| Debian APT Package Management | =0.6.20 | |
| Debian APT Package Management | =0.6.21 | |
| Debian APT Package Management | =0.6.22 | |
| Debian APT Package Management | =0.6.23 | |
| Debian APT Package Management | =0.6.24 | |
| Debian APT Package Management | =0.6.25 | |
| Debian APT Package Management | =0.6.27 | |
| Debian APT Package Management | =0.6.27-ubuntu1 | |
| Debian APT Package Management | =0.6.27-ubuntu2 | |
| Debian APT Package Management | =0.6.27-ubuntu3 | |
| Debian APT Package Management | =0.6.27-ubuntu4 | |
| Debian APT Package Management | =0.6.28 | |
| Debian APT Package Management | =0.6.29 | |
| Debian APT Package Management | =0.6.30 | |
| Debian APT Package Management | =0.6.31 | |
| Debian APT Package Management | =0.6.32 | |
| Debian APT Package Management | =0.6.33 | |
| Debian APT Package Management | =0.6.34 | |
| Debian APT Package Management | =0.6.35 | |
| Debian APT Package Management | =0.6.36 | |
| Debian APT Package Management | =0.6.36-ubuntu1 | |
| Debian APT Package Management | =0.6.37 | |
| Debian APT Package Management | =0.6.38 | |
| Debian APT Package Management | =0.6.39 | |
| Debian APT Package Management | =0.6.40 | |
| Debian APT Package Management | =0.6.40.1 | |
| Debian APT Package Management | =0.6.41 | |
| Debian APT Package Management | =0.6.42 | |
| Debian APT Package Management | =0.6.42.1 | |
| Debian APT Package Management | =0.6.42.2 | |
| Debian APT Package Management | =0.6.42.3 | |
| Debian APT Package Management | =0.6.43 | |
| Debian APT Package Management | =0.6.43.1 | |
| Debian APT Package Management | =0.6.43.2 | |
| Debian APT Package Management | =0.6.43.3 | |
| Debian APT Package Management | =0.6.44 | |
| Debian APT Package Management | =0.6.44.1 | |
| Debian APT Package Management | =0.6.44.1-0.1 | |
| Debian APT Package Management | =0.6.44.2 | |
| Debian APT Package Management | =0.6.44.2-exp1 | |
| Debian APT Package Management | =0.6.45 | |
| Debian APT Package Management | =0.6.46 | |
| Debian APT Package Management | =0.6.46.1 | |
| Debian APT Package Management | =0.6.46.2 | |
| Debian APT Package Management | =0.6.46.3 | |
| Debian APT Package Management | =0.6.46.3-0.1 | |
| Debian APT Package Management | =0.6.46.3-0.2 | |
| Debian APT Package Management | =0.6.46.4-0.1 | |
| Debian APT Package Management | =0.7.3 | |
| Debian APT Package Management | =0.7.4 | |
| Debian APT Package Management | =0.7.5 | |
| Debian APT Package Management | =0.7.6 | |
| Debian APT Package Management | =0.7.7 | |
| Debian APT Package Management | =0.7.8 | |
| Debian APT Package Management | =0.7.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012
- http://secunia.com/advisories/34829
- http://secunia.com/advisories/34832
- http://secunia.com/advisories/34874
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091
- http://www.debian.org/security/2009/dsa-1779
- http://www.securityfocus.com/bid/34630
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50086
- https://usn.ubuntu.com/762-1/
Frequently Asked Questions
What is the severity of CVE-2009-1358?
CVE-2009-1358 has been classified as a critical severity vulnerability due to the possibility of remote code execution via malicious repositories.
How do I fix CVE-2009-1358?
To fix CVE-2009-1358, upgrade the apt package to version 0.7.21 or later.
What systems are affected by CVE-2009-1358?
CVE-2009-1358 affects Debian's Advanced Package Tool (apt) versions before 0.7.21.
What kind of attack does CVE-2009-1358 enable?
CVE-2009-1358 allows attackers to exploit the vulnerability by tricking apt into accepting invalid signed repositories.
Is CVE-2009-1358 an easy vulnerability to exploit?
Yes, CVE-2009-1358 can be easily exploited by remote attackers if the vulnerable version of apt is in use.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/debian
- canonical/debian apt package management
- version/debian apt package management/0.7.20
- version/debian apt package management/0.7.0
- version/debian apt package management/0.7.1
- version/debian apt package management/0.7.2
- version/debian apt package management/0.7.2-0.1
- version/debian apt package management/0.7.10
- version/debian apt package management/0.7.11
- version/debian apt package management/0.7.12
- version/debian apt package management/0.7.13
- version/debian apt package management/0.7.14
- version/debian apt package management/0.7.15
- version/debian apt package management/0.7.15-exp1
- version/debian apt package management/0.7.15-exp2
- version/debian apt package management/0.7.15-exp3
- version/debian apt package management/0.7.16
- version/debian apt package management/0.7.17
- version/debian apt package management/0.7.17-exp1
- version/debian apt package management/0.7.17-exp2
- version/debian apt package management/0.7.17-exp3
- version/debian apt package management/0.7.17-exp4
- version/debian apt package management/0.7.18
- version/debian apt package management/0.7.19
- version/debian apt package management/0.7.20.1
- version/debian apt package management/0.7.20.2
- version/debian apt package management/0.7.21
- version/debian apt package management/0.0.1
- version/debian apt package management/0.0.2
- version/debian apt package management/0.0.3
- version/debian apt package management/0.0.4
- version/debian apt package management/0.0.5
- version/debian apt package management/0.0.6
- version/debian apt package management/0.0.7
- version/debian apt package management/0.0.8
- version/debian apt package management/0.0.9
- version/debian apt package management/0.0.10
- version/debian apt package management/0.0.11
- version/debian apt package management/0.0.12
- version/debian apt package management/0.0.13
- version/debian apt package management/0.0.13-bo1
- version/debian apt package management/0.0.14
- version/debian apt package management/0.0.15
- version/debian apt package management/0.0.15-0.1bo
- version/debian apt package management/0.0.15-0.2bo
- version/debian apt package management/0.0.16-1
- version/debian apt package management/0.0.17-1
- version/debian apt package management/0.1
- version/debian apt package management/0.1.1
- version/debian apt package management/0.1.3
- version/debian apt package management/0.1.5
- version/debian apt package management/0.1.6
- version/debian apt package management/0.1.7
- version/debian apt package management/0.1.9
- version/debian apt package management/0.3.0
- version/debian apt package management/0.3.1
- version/debian apt package management/0.3.2
- version/debian apt package management/0.3.3
- version/debian apt package management/0.3.4
- version/debian apt package management/0.3.6
- version/debian apt package management/0.3.7
- version/debian apt package management/0.3.9
- version/debian apt package management/0.3.11
- version/debian apt package management/0.3.12
- version/debian apt package management/0.3.13
- version/debian apt package management/0.3.14
- version/debian apt package management/0.3.15
- version/debian apt package management/0.3.16
- version/debian apt package management/0.3.17
- version/debian apt package management/0.3.18
- version/debian apt package management/0.3.19
- version/debian apt package management/0.5.0
- version/debian apt package management/0.5.1
- version/debian apt package management/0.5.2
- version/debian apt package management/0.5.3
- version/debian apt package management/0.5.4
- version/debian apt package management/0.5.5
- version/debian apt package management/0.5.5.1
- version/debian apt package management/0.5.6
- version/debian apt package management/0.5.7
- version/debian apt package management/0.5.8
- version/debian apt package management/0.5.9
- version/debian apt package management/0.5.10
- version/debian apt package management/0.5.11
- version/debian apt package management/0.5.12
- version/debian apt package management/0.5.13
- version/debian apt package management/0.5.14
- version/debian apt package management/0.5.15
- version/debian apt package management/0.5.16
- version/debian apt package management/0.5.17
- version/debian apt package management/0.5.18
- version/debian apt package management/0.5.19
- version/debian apt package management/0.5.20
- version/debian apt package management/0.5.21
- version/debian apt package management/0.5.22
- version/debian apt package management/0.5.23
- version/debian apt package management/0.5.24
- version/debian apt package management/0.5.25
- version/debian apt package management/0.5.26
- version/debian apt package management/0.5.27
- version/debian apt package management/0.5.28
- version/debian apt package management/0.5.29
- version/debian apt package management/0.5.30
- version/debian apt package management/0.5.30-ubuntu1
- version/debian apt package management/0.5.30-ubuntu2
- version/debian apt package management/0.5.31
- version/debian apt package management/0.5.32
- version/debian apt package management/0.6.0
- version/debian apt package management/0.6.1
- version/debian apt package management/0.6.2
- version/debian apt package management/0.6.3
- version/debian apt package management/0.6.4
- version/debian apt package management/0.6.5
- version/debian apt package management/0.6.6
- version/debian apt package management/0.6.7
- version/debian apt package management/0.6.8
- version/debian apt package management/0.6.9
- version/debian apt package management/0.6.10
- version/debian apt package management/0.6.11
- version/debian apt package management/0.6.12
- version/debian apt package management/0.6.13
- version/debian apt package management/0.6.14
- version/debian apt package management/0.6.15
- version/debian apt package management/0.6.16
- version/debian apt package management/0.6.17
- version/debian apt package management/0.6.18
- version/debian apt package management/0.6.19
- version/debian apt package management/0.6.20
- version/debian apt package management/0.6.21
- version/debian apt package management/0.6.22
- version/debian apt package management/0.6.23
- version/debian apt package management/0.6.24
- version/debian apt package management/0.6.25
- version/debian apt package management/0.6.27
- version/debian apt package management/0.6.27-ubuntu1
- version/debian apt package management/0.6.27-ubuntu2
- version/debian apt package management/0.6.27-ubuntu3
- version/debian apt package management/0.6.27-ubuntu4
- version/debian apt package management/0.6.28
- version/debian apt package management/0.6.29
- version/debian apt package management/0.6.30
- version/debian apt package management/0.6.31
- version/debian apt package management/0.6.32
- version/debian apt package management/0.6.33
- version/debian apt package management/0.6.34
- version/debian apt package management/0.6.35
- version/debian apt package management/0.6.36
- version/debian apt package management/0.6.36-ubuntu1
- version/debian apt package management/0.6.37
- version/debian apt package management/0.6.38
- version/debian apt package management/0.6.39
- version/debian apt package management/0.6.40
- version/debian apt package management/0.6.40.1
- version/debian apt package management/0.6.41
- version/debian apt package management/0.6.42
- version/debian apt package management/0.6.42.1
- version/debian apt package management/0.6.42.2
- version/debian apt package management/0.6.42.3
- version/debian apt package management/0.6.43
- version/debian apt package management/0.6.43.1
- version/debian apt package management/0.6.43.2
- version/debian apt package management/0.6.43.3
- version/debian apt package management/0.6.44
- version/debian apt package management/0.6.44.1
- version/debian apt package management/0.6.44.1-0.1
- version/debian apt package management/0.6.44.2
- version/debian apt package management/0.6.44.2-exp1
- version/debian apt package management/0.6.45
- version/debian apt package management/0.6.46
- version/debian apt package management/0.6.46.1
- version/debian apt package management/0.6.46.2
- version/debian apt package management/0.6.46.3
- version/debian apt package management/0.6.46.3-0.1
- version/debian apt package management/0.6.46.3-0.2
- version/debian apt package management/0.6.46.4-0.1
- version/debian apt package management/0.7.3
- version/debian apt package management/0.7.4
- version/debian apt package management/0.7.5
- version/debian apt package management/0.7.6
- version/debian apt package management/0.7.7
- version/debian apt package management/0.7.8
- version/debian apt package management/0.7.9