Arbitrary Code Injection

Affecting apt package, versions <1.0.9.8.5

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

References

CVSS Score

8.1
high severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE
CVE-2019-3462
Snyk ID
SNYK-DEBIAN8-APT-407401
Disclosed
28 Jan, 2019
Published
28 Jan, 2019