USN-8976-1: apt-cacher vulnerability
It was discovered that Apt-Cacher did not properly handle encoded newline characters in requests. A remote attacker could possibly use this issue to perform HTTP response splitting attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/apt-cacherto a version that resolves this vulnerability.Fixed in 1.7.11ubuntu0.16.04.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue can be exploited remotely by sending requests containing encoded newline characters to Apt-Cacher. The available information does not state that authentication or local access is required.
What systems are exposed?
Ubuntu systems using Apt-Cacher are the affected software identified in the notice. Exposure depends on an attacker being able to send requests to the Apt-Cacher service.
What is the likely impact of successful exploitation?
Successful exploitation could allow HTTP response splitting attacks. The provided information does not specify further consequences or affected response consumers.