CVE-2011-3634

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-01 · updated 2026-06-16
Weakness: CWE-200

Description

methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.

Affected products

Canonical Ubuntu Linux: 8.04, 10.04, 10.10, 11.04
Debian Advanced Package Tool: through 0.8.10.3; 0.8.0, 0.8.0-pre1, 0.8.0-pre2, 0.8.1, 0.8.10, 0.8.10.1 (+1)

References

http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
http://www.ubuntu.com/usn/USN-1283-1
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353
http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
http://www.ubuntu.com/usn/USN-1283-1
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353

Get alerted when CVE-2011-3634 or the next vulnerability affects your stack