USN-1475-1: APT update
15 June 2012
APT now more thoroughly verifies imported keyrings.
- apt - Advanced front-end for dpkg
Georgi Guninski discovered that APT relied on GnuPG argument order and did
not check GPG subkeys when validating imported keyrings via apt-key
net-update. While it appears that a machine-in-the-middle attacker cannot
exploit this, as a hardening measure this update adjusts apt-key to
validate all subkeys when checking for key collisions.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.