What’s Vulnerable › Vulnerabilities

CVE-2011-4407

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-05-14 · updated 2026-06-16
• Weakness: CWE-20

Description

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

Affected products

• Canonical software-properties: through 0.81.13.1
• Canonical Ubuntu Linux: 10.04, 10.10, 11.04, 11.10

References

• http://www.ubuntu.com/usn/USN-1352-1
• https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210
• http://www.ubuntu.com/usn/USN-1352-1
• https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210

Get alerted when CVE-2011-4407 or the next vulnerability affects your stack