CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2012-0955 – software-properties incorrectly validated TLS certificates
https://notcve.org/view.php?id=CVE-2012-0955
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92. software-properties era vulnerable a un ataque de tipo person-in-the-middle debido a una comprobación inapropiada del certificado TLS en el archivo softwareproperties/ppa.py. software-properties no comprobó los certificados TLS en python2 y solo comprobó los certificados en python3 si se proporcionó un paquete de certificado válido. Corregido en software-properties versión 0.92 • https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753 https://launchpad.net/bugs/1036839 • CWE-295: Improper Certificate Validation •
CVSS: 4.6EPSS: 0%CPEs: 14EXPL: 0CVE-2013-1061
https://notcve.org/view.php?id=CVE-2013-1061
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. dbus/SoftwarePropertiesDBus.py en Software Properties 0.92.17 anterior a 0.92.17.3, 0.92.9 anterior a la versión 0.92.9.3, y 0.82.7 anterior a 0.82.7.5 no utiliza adecuadamente D-Bus para la comunicación con una autoridad polkit, lo que permite a usuarios locales evadir restricciones de acceso intencionadas mediante el aprovechamiento de una condición de carrera a través de un proceso (1) setuid o (2) un proceso pkexec, un problema relacionado con CVE-2013-4288. • http://launchpadlibrarian.net/150156695/software-properties_0.92.17.2_0.92.17.3.diff.gz http://secunia.com/advisories/54909 http://www.ubuntu.com/usn/USN-1960-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/87381 https://launchpad.net/ubuntu/+source/software-properties/0.82.7.5 https://launchpad.net/ubuntu/+source/software-properties/0.92.17.3 https://launchpad.net/ubuntu/+source/software-properties/0.92.9.3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4407
https://notcve.org/view.php?id=CVE-2011-4407
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository. ppa.py en Software Properties anterior a 0.81.13.3 no valida el certificado de servidor cuando descarga huellas dactilares de claves GPG PPA, lo que permite a atacantes man-in-the-middle (MITM) falsificar claves GPG para un repositorio de paquete. • http://www.ubuntu.com/usn/USN-1352-1 https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210 • CWE-20: Improper Input Validation •