Security Update for unattended-upgrades
Summary
DSA-3297-1: unattended-upgrades - security update. Affects unattended-upgrades versions < 0.79.5+wheezy2. Fixed in 0.79.5+wheezy2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
unattended-upgrades is a script used for automatic installation of security upgrades in Debian distributions. It ensures that security updates are applied to the system without requiring manual intervention. This script is an essential component for maintaining the security of Debian systems.
Vulnerability Detail
The vulnerability in unattended-upgrades arises from a failure to properly authenticate downloaded packages when the force-confold or force-confnew dpkg options are enabled via the DPkg::Options::* apt configuration. This oversight could allow malicious actors to inject unauthorized packages into the system, potentially leading to arbitrary code execution or other security breaches.
How To Fix
Minimum fixed version
0.79.5+wheezy2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unattended-upgradesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of the unattended-upgrades package.
Conclusion
The vulnerability in unattended-upgrades could allow unauthorized packages to be installed on the system, posing a significant security risk. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the unattended-upgrades package. For further assistance and support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for unattended-upgrades →
FAQ
unattended-upgrades is a script used for automatic installation of security upgrades in Debian distributions. It ensures that security updates are applied to the system without requiring manual intervention.
The vulnerability could allow malicious actors to inject unauthorized packages into the system, potentially leading to arbitrary code execution or other security breaches.
To fix this vulnerability, it is recommended to upgrade the unattended-upgrades package to the fixed version. For Debian 7 (wheezy), upgrade to version 0.79.5+wheezy2. For Debian 8 (jessie), upgrade to version 0.83.3.2+deb8u1.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of the unattended-upgrades package.
For more information about this vulnerability, you can refer to the Debian Security Advisory DSA-3297-1.
Related vulnerabilities
Recent vulnerabilities recorded for unattended-upgrades.
