CVE-2014-0478
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle...
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
Exploit likelihood
What each source reports
NVD Score used
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
CVE-2014-0478- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
CVE-2014-0478- Updated
- 2026-11-02
EUVDEUVD-2014-0513 No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
EUVD-2014-0513- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3h3c-x5j6-p285 No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle...
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
GHSA-3h3c-x5j6-p285- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
CVE-2014-0478- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0478 No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
DEBIAN-CVE-2014-0478- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0478 No score
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
- Record
UBUNTU-CVE-2014-0478- Updated
- 2026-11-02
OSVUSN-2246-1 No score
apt vulnerability
Jakub Wilk discovered that APT did not correctly validate signatures when downloading source packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered source packages.
- Record
USN-2246-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.0.4 | 1.0.4 |
aptDebian:13 |
before 1.0.4 | 1.0.4 |
aptDebian:14 |
before 1.0.4 | 1.0.4 |
aptDebian:6.0 |
before 0.8.10.3+squeeze2, plus listed versions 0.8.10.30.8.10.3+squeeze1 |
0.8.10.3+squeeze2 |
aptDebian:7 |
before 0.9.7.9+deb7u2, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3 |
0.9.7.9+deb7u2 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.1, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 11 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu2 |
1.0.1ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0478 is a medium vulnerability (CVSS 4.0) in Debian Advanced Package Tool, published June 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in apt 1.0.4.