Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2011-3374: Debian apt may trust forged repository keys
CVE-2011-3374 · published 6 years ago
Summary
The apt program used to install software on Debian does not correctly check the authenticity of GPG keys, so a malicious party could insert a fake key and supply altered packages. This could let an attacker deliver harmful software during normal updates. Upgrade to a version that fixes the check and, until then, only add repositories you control and verify their keys manually.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | apt | All versions |
| Debian:12 | debian | apt | All versions |
| Debian:13 | debian | apt | All versions |
| Debian:14 | debian | apt | All versions |
| – | debian | advanced_package_tool |
All versions
cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 9.0 10.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
References
- https://security-tracker.debian.org/tracker/CVE-2011-3374 Third Party Advisory
- https://access.redhat.com/security/cve/cve-2011-3374 Broken Link
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480 Issue Tracking Mailing List Third Party Advisory
- https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html Third Party Advisory
- https://seclists.org/fulldisclosure/2011/Sep/221 Exploit Mailing List Third Party Advisory
- https://snyk.io/vuln/SNYK-LINUX-APT-116518 Broken Link
- https://ubuntu.com/security/CVE-2011-3374 Third Party Advisory
Severity
3.7
Low
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published26 Nov 2019
Updated4 Nov 2026
First seen25 Aug 2026
Track software like this
Free during beta