diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-18 09:13:52 +0100 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-18 11:43:55 +0100 |
| commit | ba245013f2801b102fdaa305fbc1bbf8b04866f8 (patch) | |
| tree | c0eec824215ef5fcb129dc29ddfe770b937ed69f /apt-pkg/cacheset.cc | |
| parent | ac0d26d4e39da16bdbf575637fd3d4b24a7fb4b8 (diff) | |
SECURITY UPDATE: content injection in http method (CVE-2019-3462)
This fixes a security issue that can be exploited to inject arbritrary debs
or other files into a signed repository as followed:
(1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is
\n encoded)
(2) apt method decodes the redirect (because the method encodes the URLs before
sending them out), writting something like
somewhere\n
<headers>
into its output
(3) apt then uses the headers injected for validation purposes.
Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec
LP: #1812353
Diffstat (limited to 'apt-pkg/cacheset.cc')
0 files changed, 0 insertions, 0 deletions