diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-18 09:13:52 +0100 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-25 12:57:36 +0100 |
| commit | 65a54dbc7965870ecd6bb73dd1e26d1d1b394bb5 (patch) | |
| tree | c331d5d0790fc553df4097b79a17a8bb9cd8c99f /apt-pkg/acquire.cc | |
| parent | 8de85181e1eee6f28db171068d4eb6c49cdbae00 (diff) | |
SECURITY UPDATE: content injection in http method (CVE-2019-3462)
This fixes a security issue that can be exploited to inject arbritrary debs
or other files into a signed repository as followed:
(1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is
\n encoded)
(2) apt method decodes the redirect (because the method encodes the URLs before
sending them out), writting something like
somewhere\n
<headers>
into its output
(3) apt then uses the headers injected for validation purposes.
Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec
LP: #1812353
Diffstat (limited to 'apt-pkg/acquire.cc')
0 files changed, 0 insertions, 0 deletions