← All KD5FMU repositories

DVSwitch-4-Me

https://github.com/KD5FMU/DVSwitch-4-Me · None · 1 finding · Review date 2026-07-11

Executive Summary

-DO NOT USE- This is the repo I have to use for now

-DO NOT USE- This is the repo I have to use for now

Summary Counts

0
Critical Security
0
High Security
1
Medium Security
0
Low Security
0
Critical Bugs
0
High Bugs
0
Medium Bugs
0
Low Bugs

Quick Reference

IDSeverityCategoryFileLinesFinding
DVS4ME-001 Medium Security trixie 42 DVSwitch GPG key downloaded over HTTP

Medium Issues

[DVS4ME-001] DVSwitch GPG key downloaded over HTTP

trixie : 42

curl http://44.15.64.51/DVSwitch_Repository/dvswitch-keyring.gpg.

Impact: MITM could substitute GPG key and enable malicious apt repo.

Recommended Fix Priority

  1. Use HTTPS with checksum verification for remote downloads