USN-1475-1: APT update

Releases

• Ubuntu 12.04
• Ubuntu 11.10
• Ubuntu 11.04
• Ubuntu 10.04
• Ubuntu 8.04

Packages

• apt - Advanced front-end for dpkg

Details

Georgi Guninski discovered that APT relied on GnuPG argument order and did
not check GPG subkeys when validating imported keyrings via apt-key
net-update. While it appears that a machine-in-the-middle attacker cannot
exploit this, as a hardening measure this update adjusts apt-key to
validate all subkeys when checking for key collisions.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.04

• apt - 0.7.9ubuntu17.5

Ubuntu 12.04

• apt - 0.8.16~exp12ubuntu10.1

Ubuntu 11.10

• apt - 0.8.16~exp5ubuntu13.4

Ubuntu 11.04

• apt - 0.8.13.2ubuntu4.5

Ubuntu 10.04

• apt - 0.7.25.3ubuntu9.12

In general, a standard system update will make all the necessary changes.

References

• https://launchpad.net/bugs/1013128