CVE-2011-3374: Medium severity Debian Advanced Package Tool vulnerability
Published Nov 25, 2019
·Updated
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
Affected Software
5 affected components
Debian Advanced Package Tool
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
debian/apt<=2.2.4, <=2.6.1, <=3.0.3, <=3.1.16
Event History
Nov 25, 2019
CVE Published
via MITRE·11:13 PM
Data Sourced
via MITRE·11:13 PM
DescriptionWeakness
Nov 26, 2019
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·09:56 PM
Description
Feb 17, 2026
Data Sourced
via Ubuntu·11:59 PM
RemedyDescriptionSeverityAffected Software
Feb 21, 2026
Data Sourced
via Debian·12:02 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-3374?
The severity of CVE-2011-3374 is medium, with a severity value of 3.7.
2
How does CVE-2011-3374 affect apt?
CVE-2011-3374 affects apt in all versions.
3
What is the potential impact of CVE-2011-3374?
The potential impact of CVE-2011-3374 is a man-in-the-middle attack.
4
Which software versions are affected by CVE-2011-3374?
CVE-2011-3374 affects the following software versions: 0.7.9ubuntu17.3, 0.7.25.3ubuntu9.7, 0.8.3ubuntu7.2, 0.8.13.2ubuntu4.2 for Ubuntu, and 1.8.2.3 up to 2.7.6 for Debian.
5
How can I fix CVE-2011-3374 in apt?
To fix CVE-2011-3374 in apt, you should update to the latest available version provided by the official distribution's package repository.