USN-2746-2
simplestreams regression
USN-2746-1 fixed a vulnerability in Simple Streams. The update caused a regression preventing MAAS from downloading PXE images. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Simple Streams did not properly perform gpg verification in some situations. A remote attacker could use this to perform a machine-in-the-middle attack and inject malicious content into the stream.
What each source reports
OSV No score
simplestreams regression
USN-2746-1 fixed a vulnerability in Simple Streams. The update caused a regression preventing MAAS from downloading PXE images. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Simple Streams did not properly perform gpg verification in some situations. A remote attacker could use this to perform a machine-in-the-middle attack and inject malicious content into the stream.
- Record
USN-2746-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simplestreamsUbuntu:14.04:LTS |
before 0.1.0~bzr341-0ubuntu2.3, plus listed versions 0.1.0~bzr318-0ubuntu10.1.0~bzr323-0ubuntu10.1.0~bzr323-0ubuntu20.1.0~bzr331-0ubuntu10.1.0~bzr341-0ubuntu10.1.0~bzr341-0ubuntu20.1.0~bzr341-0ubuntu2.10.1.0~bzr341-0ubuntu2.2 |
0.1.0~bzr341-0ubuntu2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-2746-2 is a vulnerability with no CVSS score yet in simplestreams, published September 25, 2015. No source lists public exploit code. Fixed in simplestreams 0.1.0~bzr341-0ubuntu2.3.