CVE-2013-1051

Publication date 14 March 2013

Last updated 24 July 2024

apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
apt	12.10 quantal	Fixed 0.9.7.5ubuntu5.4
	12.04 LTS precise	Fixed 0.8.16~exp12ubuntu10.10
	11.10 oneiric	Fixed 0.8.16~exp5ubuntu13.7
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not affected

How can I get the fixes?
What do statuses mean?

Notes

mdeslaur

only oneiric+ support InRelease files

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-1762-1
APT vulnerability
14 March 2013

Other references

https://www.cve.org/CVERecord?id=CVE-2013-1051