CVE-2017-7443
Fixed in a distro release EPSS <1%
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.
Products: apt-cacher-ng_project apt-cacher-ng, apt-cacher_project apt-cacher
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apt-cacher | 1.7.15 |
| Debian 12 | apt-cacher-ng | 3-1 |
| Debian 13 | apt-cacher | 1.7.15 |
| Debian 13 | apt-cacher-ng | 3-1 |
| Debian 14 | apt-cacher | 1.7.15 |
| Debian 14 | apt-cacher-ng | 3-1 |
| Debian 7 | apt-cacher | 1.7.6+deb7u1 |
| Ubuntu 16.04 LTS | apt-cacher | no fix |
| Ubuntu 16.04 LTS | apt-cacher-ng | no fix |