CVE-2019-12875

    Dashboard / Vulnerabilities / CVE-2019-12875

    CVE-2019-12875

    Published: 18 Jun 2019Last Modified: 8 Jul 2026

    Summary:

    Details: Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance of an untrusted signing key.

    References: https://security.netapp.com/advisory/ntap-20190625-0005/, https://code.foxkit.us/adelie/packages/commit/15b160780c6eeff7048063c099a7f8757e1d8391, https://github.com/sroracle/abuild/commit/4f90ce92778d0ee302e288def75591b96a397c8b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v3.4.0
    v3.4.0_rc5
    v3.4.0_rc4
    v3.4.0_rc3
    v3.4.0_rc2
    v3.4.0_rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-12875 | CVE-DB