CVE-2011-3374

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Score

CVSS 3.1 3.7 Low

Status

Modified - secalert@redhat.com

Published

2019-11-26

Last modified

2024-08-06

Weaknesses

CWE-347

Affected products

• Apt (Apt)
• Advanced Package Tool (Debian)
• Debian Linux (Debian)

References

• https://access.redhat.com/security/cve/cve-2011-3374
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480
• https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html
• https://seclists.org/fulldisclosure/2011/Sep/221
• https://security-tracker.debian.org/tracker/CVE-2011-3374
• https://snyk.io/vuln/SNYK-LINUX-APT-116518
• https://ubuntu.com/security/CVE-2011-3374