CVE-2011-3374: Debian Advanced Package Tool

Low severity, CVSS 3.7. EPSS: 1.2% chance of exploitation in the next 30 days.

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Affected products

• Debian Advanced Package Tool: any version
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only

Published 2019-11-26. Last modified 2026-06-16.