Canonical Software Properties vulnerabilities

2 vulnerabilities

Known vulnerabilities in Canonical Software Properties, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.4CVE-2012-0955canonicalsoftware-properties+1
EPSS score
0.61%
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.4.3CVE-2011-4407canonicalsoftware-properties+2
EPSS score
0.63%
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.