Canonical Software-Properties vulnerabilities

2 CVEs affecting Canonical Software-Properties, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-0955, published 2020-12-02.

More from Canonical.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2011-4407, published 2014-05-14. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys…
• CVE-2012-0955, published 2020-12-02. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under…