CVE-2012-3587
N/A
Published: June 19, 2012 at 08:00 PM UTC
Updated: June 16, 2026 at 11:43 PM UTC
1 product affected across 1 vendorAdvanced Package Tool
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 2%
Description
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
0.7.00.7.10.7.100.7.110.7.120.7.130.7.140.7.150.7.15 exp10.7.15 exp20.7.15 exp30.7.160.7.170.7.17 exp10.7.17 exp20.7.17 exp30.7.17 exp40.7.180.7.190.7.20.7.2-0.10.7.200.7.20.10.7.20.20.7.210.7.220.7.22.10.7.22.20.7.230.7.23.10.7.240.8.00.8.0 pre10.8.0 pre20.8.10.8.100.8.10.10.8.10.20.8.10.30.8.110.8.11.10.8.11.20.8.11.30.8.11.40.8.11.50.8.120.8.130.8.13.10.8.13.20.8.140.8.14.10.8.150.8.15 exp10.8.15 exp20.8.15 exp30.8.15.10.8.15.100.8.15.60.8.15.70.8.15.80.8.15.9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (4)
Mailing Listx_refsource_FULLDISC
Source: [email protected]
http://seclists.org/fulldisclosure/2012/Jun/267x_refsource_CONFIRM
Source: [email protected]
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128Quick Info
StatusMODIFIED
CWE
CWE-20
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card