CVE-2011-1829: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.

Affected products

• Canonical Ubuntu Linux: version 11.04 only
• Debian Advanced Package Tool: before 0.8.15.2 (fixed in 0.8.15.2)

Published 2011-07-27. Last modified 2026-06-16.