CVE-2012-3587

Publication date 19 June 2012

Last updated 24 July 2024

Ubuntu priority

Critical

Why this priority?

APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
apt 12.04 LTS precise
Fixed 0.8.16~exp12ubuntu10.2
11.10 oneiric
Fixed 0.8.16~exp5ubuntu13.5
11.04 natty
Fixed 0.8.13.2ubuntu4.6
10.04 LTS lucid
Fixed 0.7.25.3ubuntu9.13
8.04 LTS hardy
Fixed 0.7.9ubuntu17.6

Notes

jdstrand

LP: #1013639 disabled net-update. LP: #1013681 tracks the work needed to re-enable it safely