CVE-2014-0488
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to...
CVE-2014-0488 is a medium vulnerability (CVSS 6.8) in Debian Advanced Package Tool, published September 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in apt 1.0.9.
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
Exploit likelihood
What each source reports
NVD Score used
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
CVE-2014-0488- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
CVE-2014-0488- Updated
- 2026-11-02
EUVDEUVD-2014-0519 No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
EUVD-2014-0519- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-877r-5chx-6473 No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to...
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
GHSA-877r-5chx-6473- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
CVE-2014-0488- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0488 No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
DEBIAN-CVE-2014-0488- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0488 No score
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
- Record
UBUNTU-CVE-2014-0488- Updated
- 2026-11-02
OSVUSN-2348-1 No score
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when manually downloading packages using the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
- Record
USN-2348-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.0.9 | 1.0.9 |
aptDebian:13 |
before 1.0.9 | 1.0.9 |
aptDebian:14 |
before 1.0.9 | 1.0.9 |
aptDebian:6.0 |
before 0.8.10.3+squeeze3, plus listed versions 0.8.10.30.8.10.3+squeeze10.8.10.3+squeeze2 |
0.8.10.3+squeeze3 |
aptDebian:7 |
before 0.9.7.9+deb7u3, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3 |
0.9.7.9+deb7u3 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.3, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 12 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.1 |
1.0.1ubuntu2.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |