CVE-2009-1358: Debian Advanced Package Tool

High severity, CVSS 10.0. EPSS: 4.5% chance of exploitation in the next 30 days.

apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.

Affected products

• Debian Advanced Package Tool: up to and including 0.7.20; version 0.7.0 only; version 0.7.1 only; version 0.7.2 only; version 0.7.2-0.1 only; version 0.7.10 only; …
• Debian Apt: version 0.0.1 only; version 0.0.2 only; version 0.0.3 only; version 0.0.4 only; version 0.0.5 only; version 0.0.6 only; …

Published 2009-04-21. Last modified 2026-06-16.