Improper Certificate Validation Affecting software-properties package, versions <0.92.25debian1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-SOFTWAREPROPERTIES-1048030
- published 3 Dec 2020
- disclosed 2 Dec 2020
Introduced: 2 Dec 2020
CVE-2012-0955 Open this link in a new tabHow to fix?
Upgrade Debian:10 software-properties to version 0.92.25debian1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream software-properties package and not the software-properties package as distributed by Debian.
See How to fix? for Debian:10 relevant fixed versions and status.
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.