UBUNTU-CVE-2017-7443: Medium severity ubuntu/apt-cacher vulnerability
Published Apr 5, 2017
·Updated
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.
Affected Software
2 affected components
ubuntu/apt-cacher*
ubuntu/apt-cacher-ng*
Event History
Apr 5, 2017
CVE Published
via OSV·08:59 PM
Data Sourced
via OSV·08:59 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are affected?
Ubuntu deployments using apt-cacher versions before 1.7.15 or apt-cacher-ng versions before 3.4 are affected. The issue applies to the HTTP handling in those products.
2
What does an attacker need to exploit this issue?
The vector is network-based and requires no privileges, but user interaction is required according to the supplied severity vector. Exploitation involves encoded newline characters that are not blocked by the %0[ad] regular expression.