CVE-2019-3462
Publication date 22 January 2019
Last updated 25 August 2025
Ubuntu priority
Description
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apt | ||
| 18.04 LTS bionic |
Fixed 1.6.6ubuntu0.1
|
|
| 16.04 LTS xenial |
Fixed 1.2.29ubuntu0.1
|
|
| 14.04 LTS trusty |
Fixed 1.0.1ubuntu2.19
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.1 · High
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3863-2
- APT vulnerability
- 22 January 2019
- USN-3863-1
- APT vulnerability
- 22 January 2019