CVE-2015-1337
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files,...
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
Exploit likelihood
What each source reports
NVD Score used
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- Record
CVE-2015-1337- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- Record
CVE-2015-1337- Updated
- 2026-11-02
EUVDEUVD-2015-1477 No score
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- Record
EUVD-2015-1477- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r4f6-cvp5-f9ch No score
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files,...
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- Record
GHSA-r4f6-cvp5-f9ch- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1337 No score
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
- Record
UBUNTU-CVE-2015-1337- Updated
- 2026-11-02
OSVUSN-2746-1 No score
simplestreams vulnerability
It was discovered that Simple Streams did not properly perform gpg verification in some situations. A remote attacker could use this to perform a machine-in-the-middle attack and inject malicious content into the stream.
- Record
USN-2746-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simplestreamsUbuntu:14.04:LTS |
before 0.1.0~bzr341-0ubuntu2.2, plus listed versions 0.1.0~bzr318-0ubuntu10.1.0~bzr323-0ubuntu10.1.0~bzr323-0ubuntu20.1.0~bzr331-0ubuntu10.1.0~bzr341-0ubuntu10.1.0~bzr341-0ubuntu20.1.0~bzr341-0ubuntu2.1 |
0.1.0~bzr341-0ubuntu2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1337 is a medium vulnerability (CVSS 6.8) in Simpestreams Project Simplestreams, published September 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in simplestreams 0.1.0~bzr341-0ubuntu2.2.