CVE-2007-4739

N/A Unknown
Published: September 06, 2007 Modified: April 23, 2026
View on NVD

Description

reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://alioth.debian.org/frs/shownotes.php?release_id=1031
Source: cve@mitre.org
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440535
Source: cve@mitre.org
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5%3Bfilename=interdiff%3Batt=1%3Bbug=440535
Source: cve@mitre.org
http://osvdb.org/40172
Source: cve@mitre.org
http://secunia.com/advisories/26678
Source: cve@mitre.org
Patch Vendor Advisory
http://secunia.com/advisories/27334
Source: cve@mitre.org
http://www.debian.org/security/2007/dsa-1394
Source: cve@mitre.org
http://www.securityfocus.com/bid/25537
Source: cve@mitre.org
http://alioth.debian.org/frs/shownotes.php?release_id=1031
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440535
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5%3Bfilename=interdiff%3Batt=1%3Bbug=440535
Source: af854a3a-2127-422b-91ae-364da2661108
http://osvdb.org/40172
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/26678
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
http://secunia.com/advisories/27334
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.debian.org/security/2007/dsa-1394
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/25537
Source: af854a3a-2127-422b-91ae-364da2661108

16 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
1.5%
71th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-264

Affected Vendors

debian

Related CVEs

CVE-2026-40941 N/A
CVE-2026-40084 6.5
CVE-2026-40083 7.2
CVE-2026-40082 5.4
CVE-2026-40080 6.1