CVE-2014-0489
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums,...
CVE-2014-0489 is a high vulnerability (CVSS 7.5) in Debian Advanced Package Tool, published September 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.61%, the 89th percentile. Fixed in apt 1.0.9.
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
Exploit likelihood
What each source reports
NVD Score used
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0489- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0489- Updated
- 2026-11-02
EUVDEUVD-2014-0520 No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
EUVD-2014-0520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6q8-2q34-2w6w No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums,...
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
GHSA-x6q8-2q34-2w6w- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0489- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0489 No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
DEBIAN-CVE-2014-0489- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0489 No score
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
UBUNTU-CVE-2014-0489- Updated
- 2026-11-02
OSVUSN-2348-1 No score
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when manually downloading packages using the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
- Record
USN-2348-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.0.9 | 1.0.9 |
aptDebian:13 |
before 1.0.9 | 1.0.9 |
aptDebian:14 |
before 1.0.9 | 1.0.9 |
aptDebian:6.0 |
before 0.8.10.3+squeeze3, plus listed versions 0.8.10.30.8.10.3+squeeze10.8.10.3+squeeze2 |
0.8.10.3+squeeze3 |
aptDebian:7 |
before 0.9.7.9+deb7u3, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3 |
0.9.7.9+deb7u3 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.3, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 12 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.1 |
1.0.1ubuntu2.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |