Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
reprepro更新代码库签名验证绕过安全限制漏洞
Vulnerability Description
reprepro是用于处理debian软件包的本地代码库的工具。 reprepro在处理密钥交换时存在漏洞，远程攻击者可能利用此漏洞绕过验证。 在使用update命令升级代码库时reprepro只使用请求密钥验证签名，而请求密钥的签名根本不存在时也不会报告，因此会接收任何使用未知密钥签名的内容，这就导致不安全内容绕过了安全检查。
CVSS Information
N/A
Vulnerability Type
N/A