Information Exposure Affecting apt package, versions <0.8.11
Snyk CVSS
Attack Complexity
High
Threat Intelligence
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-APT-407476
- published 1 Mar 2014
- disclosed 1 Mar 2014
Introduced: 1 Mar 2014
CVE-2011-3634 Open this link in a new tabHow to fix?
Upgrade Debian:10
apt
to version 0.8.11 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream apt
package and not the apt
package as distributed by Debian
.
See How to fix?
for Debian:10
relevant fixed versions and status.
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
References
- https://security-tracker.debian.org/tracker/CVE-2011-3634
- http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
- https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git;a=blob;f=debian/changelog;hb=HEAD
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353
- http://www.ubuntu.com/usn/USN-1283-1
- https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD