CVE-2011-3634: Canonical Ubuntu Linux

Low severity, CVSS 2.6. EPSS: 0.8% chance of exploitation in the next 30 days.

methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.

Affected products

• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only
• Debian Advanced Package Tool: up to and including 0.8.10.3; version 0.8.0 only; version 0.8.1 only; version 0.8.10 only; version 0.8.10.1 only; version 0.8.10.2 only

Published 2014-03-01. Last modified 2026-06-16.