CVE-2011-4407 | BDVDB-2026-61538 Detail

Description#

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.ubuntu.com/usn/USN-1352-1
https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210

Exploit#

No public exploit known

History#

Version 12014-05-14Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.