CVE-2012-0955 software-properties incorrectly validated TLS certificates

HighCVSS 7.4 EPSS 0.62%

Published: 2020-12-02 02:50
Updated: 2026-10-23 21:02
Exploit status: No public exploit known

Description

software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.

Affected products

Product	Affected versions	Fixed in
debian/software-properties(Debian:12)	< 0.92.25debian1	0.92.25debian1
Canonical software-properties	>= 0.92, < 0.92	0.92
Canonical software-properties	< 0.92	0.92

References

Debian Security Tracker CVE-2012-0955 vendor-advisory
launchpad.net exploit vendor-advisory
code.launchpad.net patch vendor-advisory

CVSS v3.1

7.4 High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

All scores (5)

v3.1 6.8 · canonical
v3.1 7.4 · nvd@nist.gov
v3.1 6.8 · security@ubuntu.com
v3.1 7.4 · osv:debian
v2.0 5.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.62% (percentile 49.9)
CWE: CWE-295 Improper Certificate Validation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.