[Bug 1329274] Re: apt-get source fails to warn on unauthenticated packages
Michael Vogt
michael.vogt at canonical.com
Thu Jun 12 12:08:44 UTC 2014
** Patch added: "debdiff for saucy"
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1329274/+attachment/4130315/+files/apt_0.9.9.1%7Eubuntu3.2.debdiff
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1329274
Title:
apt-get source fails to warn on unauthenticated packages
Status in APT:
New
Status in “apt” package in Ubuntu:
In Progress
Status in “apt” source package in Lucid:
New
Status in “apt” source package in Precise:
New
Status in “apt” source package in Saucy:
New
Status in “apt” source package in Trusty:
New
Status in “apt” source package in Utopic:
In Progress
Bug description:
apt-get source foo will not warn if the repository that foo belongs to
has no signature attached.
It should fails in this case - this is CVE-2014-0478
To manage notifications about this bug go to:
https://bugs.launchpad.net/apt/+bug/1329274/+subscriptions
More information about the foundations-bugs
mailing list