Vulnerability Description
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Software-Properties | <= 0.81.13.1 |
| Canonical | Ubuntu Linux | 10.04 |
Related Weaknesses (CWE)
References
- http://www.ubuntu.com/usn/USN-1352-1
- https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210
- http://www.ubuntu.com/usn/USN-1352-1
- https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210
FAQ
What is CVE-2011-4407?
CVE-2011-4407 is a vulnerability with a CVSS score of 4.3 (MEDIUM). ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for...
How severe is CVE-2011-4407?
CVE-2011-4407 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-4407?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Software-Properties, Canonical Ubuntu Linux.