From 2e3c9d6452e69dcb5c83732fbda27b747bc997f4 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Mon, 6 Jun 2011 21:29:16 +0200 Subject: * apt-pkg/indexcopy.cc: - Verify that the first line of an InRelease file is a PGP header for a signed message. Otherwise a man-in-the-middle can prefix a valid InRelease file with his own data! (CVE-2011-1829) --- debian/changelog | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 971cf53b7..c2cf8257e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -16,6 +16,10 @@ apt (0.8.14.2) UNRELEASED; urgency=low * Galician translation update (Miguel Anxo Bouzada). Closes: #626505 [ David Kalnischkies ] + * apt-pkg/indexcopy.cc: + - Verify that the first line of an InRelease file is a PGP header + for a signed message. Otherwise a man-in-the-middle can prefix + a valid InRelease file with his own data! (CVE-2011-1829) * fix a bunch of cppcheck warnings/errors based on a patch by Niels Thykier, thanks! (Closes: #622805) * apt-pkg/depcache.cc: @@ -78,7 +82,7 @@ apt (0.8.14.2) UNRELEASED; urgency=low - show Acquire::Languages and APT::Architectures settings in 'dump' (Closes: 626739) - -- David Kalnischkies Sat, 28 May 2011 10:54:23 +0200 + -- David Kalnischkies Mon, 06 Jun 2011 21:24:28 +0200 apt (0.8.14.1) unstable; urgency=low -- cgit v1.2.3