apt-get source fails to warn on unauthenticated packages

[Michael Vogt]

apt-get source foo will not warn if the repository that foo belongs to has no signature attached.

It should fails in this case - this is CVE-2014-0478

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.9.9.1~ubuntu3.2

---------------
apt (0.9.9.1~ubuntu3.2) saucy-security; urgency=low

  * SECURITY UPDATE: incorrect apt-get source validation (LP: #1329274)
    - warn if not authenticated in cmdline/apt-get.cc, added regression
      test to test/integration/test-apt-get-source-authenticated,
      test/integration/framework.
    - CVE-2014-0478
 -- Michael Vogt <email address hidden> Thu, 12 Jun 2014 14:02:26 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 1.0.1ubuntu2.1

---------------
apt (1.0.1ubuntu2.1) trusty-security; urgency=low

  * SECURITY UPDATE: incorrect apt-get source validation (LP: #1329274)
    - warn if not authenticated in apt-private/private-download.*,
      cmdline/apt-get.cc, added regression test to
      test/integration/test-apt-get-source-authenticated.
    - CVE-2014-0478
 -- Michael Vogt <email address hidden> Thu, 12 Jun 2014 13:57:38 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.8.16~exp12ubuntu10.17

---------------
apt (0.8.16~exp12ubuntu10.17) precise-security; urgency=low

  * SECURITY UPDATE: incorrect apt-get source validation (LP: #1329274)
    - warn if not authenticated in cmdline/apt-get.cc, added regression
      test to test/integration/test-apt-get-source-authenticated,
      test/integration/framework.
    - CVE-2014-0478
 -- Michael Vogt <email address hidden> Thu, 12 Jun 2014 14:12:19 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.7.25.3ubuntu9.15

---------------
apt (0.7.25.3ubuntu9.15) lucid-security; urgency=low

  * SECURITY UPDATE: incorrect apt-get source validation (LP: #1329274)
    - warn if not authenticated in cmdline/apt-get.cc.
    - CVE-2014-0478
 -- Michael Vogt <email address hidden> Thu, 12 Jun 2014 15:10:43 +0200

[TheoB (theo-y)]

I don't know why I land up here. The PC tells me there are updates and then it refuses to install the updates. I'm told to check my
connection but my connection is solid !!!

Thank you
Theo

[Forest Bond (forest-bond)]

Question: Why are --force-yes and --assume-yes not honored as they are when checking authenticity of binaries?

[Marc Deslauriers (mdeslaur)]

@ Forest Bond: Please file a new bug, this bug is closed.

[Forest Bond (forest-bond)]

Or at least just --force-yes. --assume-yes is not sufficient to bypass the authenticity check without a prompt. I gather there is a desire to avoid prompting.