CVE-2011-4407

Published: May 14, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

Affected (5)

Products: Canonical: Software Properties, Ubuntu Linux

Canonical

2 products

Software Properties

Ubuntu Linux

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Software Properties	Up to 0.81.13.1
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 11.04
Canonical Ubuntu Linux	Version 11.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.ubuntu.com/usn/USN-1352-1

Source: security@ubuntu.com

https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210

Source: security@ubuntu.com

http://www.ubuntu.com/usn/USN-1352-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.