CVE-2007-4739

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-06 · updated 2026-06-16
Weakness: CWE-264

Description

reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.

Affected products

Debian Reprepro: 1.3.0, 1.3.1, 2.0.0, 2.1.0, 2.2.0, 2.2.1 (+2)

References

http://alioth.debian.org/frs/shownotes.php?release_id=1031
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440535
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5%3Bfilename=interdiff%3Batt=1%3Bbug=440535
http://osvdb.org/40172
http://secunia.com/advisories/26678
http://secunia.com/advisories/27334
http://www.debian.org/security/2007/dsa-1394
http://www.securityfocus.com/bid/25537
http://alioth.debian.org/frs/shownotes.php?release_id=1031
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440535
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5%3Bfilename=interdiff%3Batt=1%3Bbug=440535
http://osvdb.org/40172

Get alerted when CVE-2007-4739 or the next vulnerability affects your stack