CVE-2011-3634
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
01/03/2014
Last modified:
12/04/2025
Description
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
Impact
Base Score 2.0
2.60
Severity 2.0
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:* | 0.8.10.3 (including) | |
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre1:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre2:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.10:*:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.10.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:debian:advanced_package_tool:0.8.10.2:*:*:*:*:*:*:* | ||
| cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts:*:*:*:*:* | ||
| cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:* | ||
| cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* | ||
| cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
- http://www.ubuntu.com/usn/USN-1283-1
- https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba%3Dblob%3Bf%3Ddebian/changelog%3Bhb%3DHEAD
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353
- http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
- http://www.ubuntu.com/usn/USN-1283-1
- https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba%3Dblob%3Bf%3Ddebian/changelog%3Bhb%3DHEAD
- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353