[Bug 1016643] Re: add-apt-repository downloads gpg key in an insecure fashion
dkg
dkg at fifthhorseman.net
Mon Sep 17 17:38:52 UTC 2012
I don't think this bug is fixed. it looks to me like the keyserver
operator (or anyone who can MITM the keyserver) can still inject
arbitrary keys here.
/usr/share/pyshared/softwareproperties/ppa.py appears to run "apt-key
adv --keyserver $whatever --recv $fingerprint"
and "apt-key adv" is just shelling out to gpg.
if your keyserver happens to return the wrong thing (whether by malice
or by accident), it will still just get imported.
If you'd like to try, consider using the (absurdly low-fi) fake
"keyserver" hkp://dkg.fifthhorseman.net:80/, which will always return my
key, regardless of what keyid (or fingerprint) you request from it.
add-apt-repository --keyserver hkp://dkg.fifthhorseman.net:80/ ppa
:kernel-ppa/ppa
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to software-properties in Ubuntu.
https://bugs.launchpad.net/bugs/1016643
Title:
add-apt-repository downloads gpg key in an insecure fashion
Status in GNU Privacy Guard:
Fix Released
Status in “gnupg” package in Ubuntu:
Fix Released
Status in “gnupg2” package in Ubuntu:
Fix Released
Status in “software-properties” package in Ubuntu:
Invalid
Status in “gnupg” source package in Lucid:
Fix Released
Status in “gnupg2” source package in Lucid:
Fix Released
Status in “software-properties” source package in Lucid:
Invalid
Status in “gnupg” source package in Natty:
Fix Released
Status in “gnupg2” source package in Natty:
Fix Released
Status in “software-properties” source package in Natty:
Invalid
Status in “gnupg” source package in Oneiric:
Fix Released
Status in “gnupg2” source package in Oneiric:
Fix Released
Status in “software-properties” source package in Oneiric:
Invalid
Status in “gnupg” source package in Precise:
Fix Released
Status in “gnupg2” source package in Precise:
Fix Released
Status in “software-properties” source package in Precise:
Invalid
Status in “gnupg” source package in Quantal:
Fix Released
Status in “gnupg2” source package in Quantal:
Fix Released
Status in “software-properties” source package in Quantal:
Invalid
Status in “gnupg” source package in Hardy:
Fix Released
Status in “gnupg2” source package in Hardy:
Fix Released
Status in “software-properties” source package in Hardy:
Invalid
Bug description:
add-apt-repository can add PPAs and automatically import the PPA gpg
key.
Unfortunately, it uses apt-key, which in turn uses gpg to download the
key from a keyserver.
gpg downloads keys from keyservers using the short key id, which is
trivial to collide.
It is therefore possible to either MITM the point where gpg downloads
the key from the keyserver, or to simply upload a second colliding key
to the keyserver. This can result in being able to MITM packages
installed from PPAs.
To manage notifications about this bug go to:
https://bugs.launchpad.net/gnupg/+bug/1016643/+subscriptions
More information about the foundations-bugs
mailing list