CVE-2009-1358: apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat...

Security readout for executives and security teams

This flaw affects old versions of apt-get, the package installation tool used on Debian and Ubuntu systems. It could incorrectly accept a repository signed with an expired or revoked key, weakening package-source trust and potentially allowing malicious software installation if a user or system is directed to such a repository. Exposure is mainly legacy Debian or Ubuntu systems running apt before 0.7.21, or unmanaged images derived from that era. Modern supported distributions are unlikely to remain affected, but old appliances, frozen base images, and disconnected environments need inventory confirmation. Prioritize remediation for any legacy Linux estate using old apt versions because package-manager trust failures can become full system compromise. For supported modern systems, treat this as an inventory and legacy-risk cleanup item rather than an emergency. Mitigation focus: Upgrade apt to a vendor-fixed version, at least 0.7.21 where applicable.; Apply Debian DSA-1779 or Ubuntu USN-762-1 guidance for affected systems.; Remove untrusted or obsolete package repositories from managed hosts..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.