CVE-2011-3374 Security feature bypass in apt
A flaw in apt-key allows man-in-the-middle attacks to bypass GPG key validation, potentially enabling malicious package installation and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-3374?
CVE-2011-3374 is a low-severity vulnerability in Debian Debian Linux, published on 25 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
Weakness: CWE-347
Which versions are affected by CVE-2011-3374?
It affects 2 products.
Products include Debian Advanced Package Tool, Debian Debian Linux.
How do I fix CVE-2011-3374?
No fix has been published for CVE-2011-3374 yet. Limit exposure of the affected software until one is available.
Is CVE-2011-3374 being exploited?
There is no known exploitation of CVE-2011-3374 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2011-3374, GHSA-xpxf-p5mx-cq4f.