Back to Database
Status published
High
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport...
Vulnerability Description
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-3462
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/106690
- https://usn.ubuntu.com/3863-1/
- https://usn.ubuntu.com/3863-2/
- https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html
- https://www.debian.org/security/2019/dsa-4371
- https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html
- https://security.netapp.com/advisory/ntap-20190125-0002/
- https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E
More from Debian GNU/Linux
View All →CVE-2019-3464
Insufficient sanitization of environment variables passed to rsync can bypass...
Critical
9.8
CVE-2019-3463
Insufficient sanitization of arguments passed to rsync can bypass the...
Critical
9.8
CVE-2019-3461
Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing...
High
7
Affected Vendor
Debian GNU/Linux
View all reports →Affected Software
apt as used in Debian Stretch and Ubuntu
Vulnerable Versions:
1.4.8 and earlier
Timeline
Official Publish:
January 28th, 2019
Last Modified:
September 16th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.