The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LT...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 apt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4~beta2"}]}]

Debian:13 apt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4~beta2"}]}]

Debian:14 apt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4~beta2"}]}]

参照URL

advisory security-tracker.debian.org