- Vulnerability/
- USN-3863-1
USN-3863-1: APT vulnerability
First published: Tue Jan 22 2019(Updated: )
Max Justicz discovered that APT incorrectly handled certain parameters during redirects. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/apt | <1.7.0ubuntu0.1 | 1.7.0ubuntu0.1 |
| =18.10 | ||
| All of | ||
| ubuntu/apt | <1.6.6ubuntu0.1 | 1.6.6ubuntu0.1 |
| =18.04 | ||
| All of | ||
| ubuntu/apt | <1.2.29ubuntu0.1 | 1.2.29ubuntu0.1 |
| =16.04 | ||
| All of | ||
| ubuntu/apt | <1.0.1ubuntu2.19 | 1.0.1ubuntu2.19 |
| =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2019-3462
- https://ubuntu.com/security/notices/USN-3863-2
- https://launchpad.net/ubuntu/+source/apt/1.7.0ubuntu0.1
- https://launchpad.net/ubuntu/+source/apt/1.6.6ubuntu0.1
- https://launchpad.net/ubuntu/+source/apt/1.2.29ubuntu0.1
- https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.19
- https://ubuntu.com/security/notices/USN-3863-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is USN-3863-1.
How does APT handle certain parameters during redirects?
APT incorrectly handles certain parameters during redirects.
What could a remote attacker potentially do with this vulnerability?
A remote attacker could potentially use this vulnerability to install altered packages.
Which versions of APT are affected by this vulnerability?
Versions 1.7.0ubuntu0.1, 1.6.6ubuntu0.1, 1.2.29ubuntu0.1, and 1.0.1ubuntu2.19 of APT are affected by this vulnerability.
How can I fix this vulnerability?
You can fix this vulnerability by updating APT to version 1.7.0ubuntu0.1 or applying the corresponding security patches.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-3863-2
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/18.10
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04
- version/ubuntu ubuntu/14.04