summaryrefslogtreecommitdiff
path: root/apt-pkg
diff options
context:
space:
mode:
authorMichael Vogt <egon@debian-devbox>2012-03-06 17:22:44 +0100
committerMichael Vogt <egon@debian-devbox>2012-03-06 17:22:44 +0100
commitb7a6594d1e5ed199a7a472b78b33e070375d6f92 (patch)
treebc48e5e11c76282abe9fee5baef949181cbc9cae /apt-pkg
parent032ad7384e4529d95966a9c88fd5e11dd11c31f3 (diff)
* apt-pkg/acquire-item.cc:
- remove 'old' InRelease file if we can't get a new one before proceeding with Release.gpg to avoid the false impression of a still trusted repository by a (still present) old InRelease file. Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214)
Diffstat (limited to 'apt-pkg')
-rw-r--r--apt-pkg/acquire-item.cc7
1 files changed, 7 insertions, 0 deletions
diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 39ce90dda..eda45d7be 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1608,6 +1608,13 @@ void pkgAcqMetaClearSig::Failed(string Message,pkgAcquire::MethodConfig *Cnf) /*
{
if (AuthPass == false)
{
+ // Remove the 'old' InRelease file if we try Release.gpg now as otherwise
+ // the file will stay around and gives a false-auth impression (CVE-2012-0214)
+ string FinalFile = _config->FindDir("Dir::State::lists");
+ FinalFile.append(URItoFileName(RealURI));
+ if (FileExists(FinalFile))
+ unlink(FinalFile.c_str());
+
new pkgAcqMetaSig(Owner,
MetaSigURI, MetaSigURIDesc, MetaSigShortDesc,
MetaIndexURI, MetaIndexURIDesc, MetaIndexShortDesc,