CVE-2018-0501

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-21 · updated 2026-06-17
Weakness: CWE-347

Description

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.

Affected products

Canonical Ubuntu Linux: 18.04
Debian Advanced Package Tool: from 1.6.0 before 1.6.4; 1.7.0-alpha, 1.7.0-alpha1, 1.7.0-alpha2 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: Debian Advanced Package Tool 1.6.4. Check the vendor advisory for mitigations.

References

https://mirror.fail
https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec
https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47
https://usn.ubuntu.com/3746-1/
https://mirror.fail
https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec
https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47
https://usn.ubuntu.com/3746-1/

Get alerted when CVE-2018-0501 or the next vulnerability affects your stack