CVE-2011-4407

Name	CVE-2011-4407
Description	ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
software-properties (PTS)	bookworm	0.99.30-4.1~deb12u1	fixed
	sid	0.111-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
software-properties	source	lenny	(not affected)
software-properties	source	squeeze	(not affected)
software-properties	source	(unstable)	0.76.7debian2+nmu2

Notes

[squeeze] - software-properties <not-affected> (Vulnerable code not present)
[lenny] - software-properties <not-affected> (Vulnerable code not present)
https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/915210/