diff options
author | David Kalnischkies <kalnischkies@gmail.com> | 2012-03-04 22:50:21 +0100 |
---|---|---|
committer | David Kalnischkies <kalnischkies@gmail.com> | 2012-03-04 22:50:21 +0100 |
commit | de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 (patch) | |
tree | f7be862922cb9735027f53e9cde8bfe9bf6dc4db /po/he.po | |
parent | 43c1ca5d1eb8101e3a52d19a2175c14817e6dd14 (diff) |
* apt-pkg/acquire-item.cc:
- remove 'old' InRelease file if we can't get a new one before
proceeding with Release.gpg to avoid the false impression of a still
trusted repository by a (still present) old InRelease file.
Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214)
Effected are all versions >= 0.8.11
Possible attack summary:
- Attacker needs to find a user which has run at least one successful
'apt-get update' against an archive providing InRelease files.
- Create a Packages file with his preferred content.
- Attacker then prevents the download of InRelease, Release and
Release.gpg (alternatively he creates a valid Release file and sends
this, the other two files need to be missing either way).
- User updates against this, getting the modified Packages file without
any indication of being unsigned (beside the "Ign InRelease" and
"Ign Release.gpg" in the output of 'apt-get update').
=> deb files from this source are considered 'trusted' (and therefore the
user isn't asked for an additional confirmation before install)
Diffstat (limited to 'po/he.po')
0 files changed, 0 insertions, 0 deletions