RSS   Vulnerabilities for 'Software-properties'   RSS

2020-12-02
 
CVE-2012-0955

CWE-295
 

 
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.

 
2014-05-13
 
CVE-2011-4407

CWE-20
 

 
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

 

 >>> Vendor: Canonical 40 Products
Ubuntu linux
Reportbug
Spread
Bazaar
Apparmor
Checkinstall
Ubuntu
Ubuntu enterprise cloud
Accountsservice
PHP5
Ubuntu software properties
Telepathy-idle
Software-properties
Apt-xapian-index
MAAS
Metal as a service
Libpam-modules
Update-manager
Ltsp display manager
Acpi-support
Lxcfs
Ubuntu core
Ubuntu touch
Ubuntu-core-launcher
LXD
Openstack ironic
JUJU
Ubuntu-image
Screen-resolution-extra
Ubuntu download manager
Snapd
Cloud-init
Ubuntu cobbler
Microk8s
C-kernel
Subiquity
Ubuntu-ui-toolkit
Remote-login-service
Courier-authlib
Multipass


Copyright 2024, cxsecurity.com

 

Back to Top