* merged from the debian-sid branch, most notably:

[apt.git] / apt-pkg / acquire-item.cc

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index f231c42b4219e7e0e871376fd98f9423934ba438..6e6c35381d977aed09d861f76f086a2ae329119f 100644 (file)
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1620,6 +1620,13 @@ void pkgAcqMetaClearSig::Failed(string Message,pkgAcquire::MethodConfig *Cnf) /*
 {
    if (AuthPass == false)
    {
 {
    if (AuthPass == false)
    {

+      // Remove the 'old' InRelease file if we try Release.gpg now as otherwise
+      // the file will stay around and gives a false-auth impression (CVE-2012-0214)
+      string FinalFile = _config->FindDir("Dir::State::lists");
+      FinalFile.append(URItoFileName(RealURI));
+      if (FileExists(FinalFile))
+        unlink(FinalFile.c_str());
+

       new pkgAcqMetaSig(Owner,
                        MetaSigURI, MetaSigURIDesc, MetaSigShortDesc,
                        MetaIndexURI, MetaIndexURIDesc, MetaIndexShortDesc,
       new pkgAcqMetaSig(Owner,
                        MetaSigURI, MetaSigURIDesc, MetaSigShortDesc,
                        MetaIndexURI, MetaIndexURIDesc, MetaIndexShortDesc,