[OE-core] [master] [PATCH] apt: mark CVE-2011-3374 as not-applicable-config

[OE-core] [master] [PATCH] apt: mark CVE-2011-3374 as not-applicable-config

[Anil Dongare -X (adongare - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Anil Dongare <adongare@cisco.com>

Details: https://security-tracker.debian.org/tracker/CVE-2011-3374

CVE-2011-3374 describes a design flaw in the legacy apt-key trust model.

This does not apply to the current apt recipe in OE-Core because it uses
Debian vendor configuration. Debian security tracker notes this issue is not
exploitable in Debian since no keyring URI is defined for the apt-key
net-update path.

Mark this CVE as not-applicable-config for the recipe. This is a
configuration-based status, not a fixed-version status.

Signed-off-by: Anil Dongare <adongare@cisco.com>
---
 meta/recipes-devtools/apt/apt_3.0.3.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-devtools/apt/apt_3.0.3.bb b/meta/recipes-devtools/apt/apt_3.0.3.bb
index 08b6bac2e4..03da3fbcf1 100644
--- a/meta/recipes-devtools/apt/apt_3.0.3.bb
+++ b/meta/recipes-devtools/apt/apt_3.0.3.bb
@@ -34,6 +34,10 @@ UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/a/apt/"
 # to express 'divisible by 4 plus 2' in regex (that I know of), let's hardcode a few.
 UPSTREAM_CHECK_REGEX = "[^\d\.](?P<pver>((2\.2)|(2\.6)|(3\.0)|(3\.4)|(3\.8)|(4\.2))(\.\d+)+)\.tar"
 
+# Not applicable: this OE-Core apt recipe uses Debian vendor configuration,
+# which does not define a keyring URI for the apt-key net-update path.
+CVE_STATUS[CVE-2011-3374] = "not-applicable-config: OE-Core apt uses Debian vendor configuration, which defines no keyring URI for the apt-key net-update path"
+
 inherit cmake perlnative bash-completion useradd
 
 # User is added to allow apt to drop privs, will runtime warn without
-- 
2.44.4

Re: [OE-core] [master] [PATCH] apt: mark CVE-2011-3374 as not-applicable-config

[Yoann Congal]

On Mon Jun 29, 2026 at 2:45 PM CEST, Anil Dongare -X (adongare - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Anil Dongare <adongare@cisco.com>

Hello,

> Details: https://security-tracker.debian.org/tracker/CVE-2011-3374
>
> CVE-2011-3374 describes a design flaw in the legacy apt-key trust model.
>
> This does not apply to the current apt recipe in OE-Core because it uses
> Debian vendor configuration. Debian security tracker notes this issue is not
> exploitable in Debian since no keyring URI is defined for the apt-key
> net-update path.
>
> Mark this CVE as not-applicable-config for the recipe. This is a
> configuration-based status, not a fixed-version status.
Why? I tend to disagree. To me, it should be a "fixed-version" because
the impacted code was simply removed, no configuration can bring the
vulnerability back!

(I'm trying to avoid users having to confirm they are not impacted in
their configuration)

This quote of my review of V1 still apply: https://lore.kernel.org/openembedded-core/DJ9HM01CT21Q.2HLOH1RLAP4JN@smile.fr/:
|Also, please add a justification for
|"apt-key net-update is disabled by default"
|In this case, the commit:
|  Use sq in the test suite, remove apt-key
|  https://salsa.debian.org/apt-team/apt/-/commit/a00fbbdb2
|is present since 2.9.19.
|
|Finally, in this case, the "fixed-version" CVE_STATUS might be more
|appropriate. (Maybe reflect the new status in the patch title)

>
> Signed-off-by: Anil Dongare <adongare@cisco.com>
> ---
>  meta/recipes-devtools/apt/apt_3.0.3.bb | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/meta/recipes-devtools/apt/apt_3.0.3.bb b/meta/recipes-devtools/apt/apt_3.0.3.bb
> index 08b6bac2e4..03da3fbcf1 100644
> --- a/meta/recipes-devtools/apt/apt_3.0.3.bb
> +++ b/meta/recipes-devtools/apt/apt_3.0.3.bb
> @@ -34,6 +34,10 @@ UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/a/apt/"
>  # to express 'divisible by 4 plus 2' in regex (that I know of), let's hardcode a few.
>  UPSTREAM_CHECK_REGEX = "[^\d\.](?P<pver>((2\.2)|(2\.6)|(3\.0)|(3\.4)|(3\.8)|(4\.2))(\.\d+)+)\.tar"
>  
> +# Not applicable: this OE-Core apt recipe uses Debian vendor configuration,
> +# which does not define a keyring URI for the apt-key net-update path.
> +CVE_STATUS[CVE-2011-3374] = "not-applicable-config: OE-Core apt uses Debian vendor configuration, which defines no keyring URI for the apt-key net-update path"
I still disagree with "not-applicable-config:" here. I think it should
be "fixed-version:" (with an updated justification)

> +
>  inherit cmake perlnative bash-completion useradd
>  
>  # User is added to allow apt to drop privs, will runtime warn without

Regards,
-- 
Yoann Congal
Smile ECS

[OE-core][PATCH v2] apt: mark CVE-2011-3374 as fixed-version

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

CVE-2011-3374 affects the legacy apt-key net-update command [1].

Upstream removed apt-key in apt 2.9.19 [2]. OE-Core uses apt 3.0.3,
so the vulnerable code is no longer present and cannot be restored by
configuration.

Mark the CVE as fixed-version.

[1] https://security-tracker.debian.org/tracker/CVE-2011-3374
[2] https://salsa.debian.org/apt-team/apt/-/commit/a00fbbdb2

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
Changes in v2:
- Use fixed-version instead of not-applicable-config because apt-key was
  removed in apt 2.9.19.
- Shorten the CVE_STATUS explanation and add supporting references.

 meta/recipes-devtools/apt/apt_3.0.3.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-devtools/apt/apt_3.0.3.bb b/meta/recipes-devtools/apt/apt_3.0.3.bb
index 08b6bac2e4..7c72f489a3 100644
--- a/meta/recipes-devtools/apt/apt_3.0.3.bb
+++ b/meta/recipes-devtools/apt/apt_3.0.3.bb
@@ -34,6 +34,9 @@ UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/a/apt/"
 # to express 'divisible by 4 plus 2' in regex (that I know of), let's hardcode a few.
 UPSTREAM_CHECK_REGEX = "[^\d\.](?P<pver>((2\.2)|(2\.6)|(3\.0)|(3\.4)|(3\.8)|(4\.2))(\.\d+)+)\.tar"
 
+# apt-key, including the vulnerable net-update path, was removed in 2.9.19.
+CVE_STATUS[CVE-2011-3374] = "fixed-version: apt-key was removed in 2.9.19"
+
 inherit cmake perlnative bash-completion useradd
 
 # User is added to allow apt to drop privs, will runtime warn without
-- 
2.35.6

Re: [master] [PATCH] apt: mark CVE-2011-3374 as not-applicable-config

[Devansh Patel]

[-- Attachment #1: Type: text/plain, Size: 453 bytes --]

Hello Yoann,

Thank you for the review. Anil has been working with our team on this
patch, but he is currently on medical leave, so I picked up the work and
submitted the corrected v2.

The v2 uses fixed-version and updates the justification to note that
apt-key was removed in apt 2.9.19, with supporting references.

The corrected v2 is available here:
https://lists.openembedded.org/g/openembedded-core/message/243341

Regards,
Devansh

[-- Attachment #2: Type: text/html, Size: 516 bytes --]