summaryrefslogtreecommitdiff
path: root/configure.ac
diff options
context:
space:
mode:
authorJulian Andres Klode <jak@debian.org>2015-08-21 18:00:37 +0200
committerJulian Andres Klode <jak@debian.org>2015-08-27 19:50:20 +0200
commit138e0ff0f39db21178515ebad4750088c281fcb1 (patch)
tree0d38113bc5a4cb5cc7f443ac25f64030838df1f4 /configure.ac
parentda7cdbecff3128fb725b7fdef917d7df4a7dfaac (diff)
Do not parse Status fields from remote sources
This could allow an attacker to mark a package as installed in a remote package index, as long as the package was not listed in the dpkg status file. This way, an attacker could force the installation of a package during a dist-upgrade, by providing two packages in an index, an older marked as installed, and a newer - apt would "upgrade" to the newer version.
Diffstat (limited to 'configure.ac')
0 files changed, 0 insertions, 0 deletions