CVE-2019-11480
14.04.2020, 02:15
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16Enginsight
Vendor | Product | Version |
---|---|---|
canonical | c-kernel | 𝑥 ≤ 2019-07-16 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-353 - Missing Support for Integrity CheckThe software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.