diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-18 09:13:52 +0100 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2019-01-22 12:50:59 +0100 |
| commit | 5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b (patch) | |
| tree | ef175cd009c79c9450ea3d7d409f0f8aafcc8155 /apt-private/private-cachefile.cc | |
| parent | b1314a7f81cde0b4320ad9296d8fcc9bd6fbc55f (diff) | |
SECURITY UPDATE: content injection in http method (CVE-2019-3462)
This fixes a security issue that can be exploited to inject arbritrary debs
or other files into a signed repository as followed:
(1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is
\n encoded)
(2) apt method decodes the redirect (because the method encodes the URLs before
sending them out), writting something like
somewhere\n
<headers>
into its output
(3) apt then uses the headers injected for validation purposes.
Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec
LP: #1812353
Diffstat (limited to 'apt-private/private-cachefile.cc')
0 files changed, 0 insertions, 0 deletions