CVE-2019-3462: apt - Incorrect sanitation of the 302 redirect field in HTTP transport method
Summary
CVE-2019-3462: Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machi... Affects apt versions < 1.8.0~alpha3.1. Fixed in 1.8.0~alpha3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'apt' package is a command-line tool used for package management in Ubuntu. It is responsible for handling the installation, upgrade, and removal of software packages. The vulnerability, CVE-2019-3462, affects apt versions 1.4.8 and earlier. It arises from the incorrect sanitation of the 302 redirect field in the HTTP transport method.
Vulnerability Detail
The vulnerability allows a Man-in-the-Middle (MITM) attacker to inject content and potentially execute remote code on the target machine. By manipulating the 302 redirect field, an attacker can trick the apt package manager into downloading and installing malicious packages. This can lead to unauthorized access, data compromise, and system compromise.
How To Fix
Minimum fixed version
1.8.0~alpha3.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade aptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the 'apt' package to the latest version.
Conclusion
The vulnerability in the 'apt' package allows for content injection and potential remote code execution. It is crucial to update the package to the fixed version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apt →
FAQ
The vulnerability allows an attacker to inject malicious content and potentially execute remote code on the target machine. This can lead to unauthorized access, data compromise, and system compromise.
The vulnerability affects 'apt' versions 1.4.8 and earlier.
No, there is no known workaround. It is essential to update the 'apt' package to the latest version.
You can update the 'apt' package by running the following command: sudo apt-get update && sudo apt-get upgrade
You can find more information about this vulnerability on the Ubuntu CVE Tracker: https://git.launchpad.net/ubuntu-cve-tracker
Related vulnerabilities
Recent vulnerabilities recorded for apt.
