What’s Vulnerable › Vulnerabilities

CVE-2011-3374

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-11-26 · updated 2026-06-16
• Weakness: CWE-347

Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Affected products

• Debian Advanced Package Tool: all versions
• Debian Linux: 8.0, 9.0, 10.0

References

• https://access.redhat.com/security/cve/cve-2011-3374
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480
• https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html
• https://seclists.org/fulldisclosure/2011/Sep/221
• https://security-tracker.debian.org/tracker/CVE-2011-3374
• https://snyk.io/vuln/SNYK-LINUX-APT-116518
• https://ubuntu.com/security/CVE-2011-3374
• https://access.redhat.com/security/cve/cve-2011-3374
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480
• https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html
• https://seclists.org/fulldisclosure/2011/Sep/221
• https://security-tracker.debian.org/tracker/CVE-2011-3374

Get alerted when CVE-2011-3374 or the next vulnerability affects your stack