Improper input validation in Canonical Software-Properties
CVE-2011-4407
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.
Affected products
- Canonical Software-properties
- Canonical Ubuntu_linux — versions 10.04, 10.10, 11.04
- N/a — versions n/a
Weakness classification (CWE)
References
- security@ubuntu.com (x_refsource_UBUNTU, vendor-advisory)
- security@ubuntu.com (x_refsource_CONFIRM)