Debian/reprepro: unknown

reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing i

Action: Upgrade reprepro to 2.2.4-1 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2007-4739
• https://security-tracker.debian.org/tracker/CVE-2007-4739

published 2007-09-06T19:17:00Z · modified 2026-10-21T17:47:35.659842433Z · JSON