{"api_version":"1","generated_at":"2026-07-23T07:48:16+00:00","cve":"CVE-2012-0954","urls":{"html":"https://cve.report/CVE-2012-0954","api":"https://cve.report/api/cve/CVE-2012-0954.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-0954","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-0954"},"summary":{"title":"CVE-2012-0954","description":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.","state":"PUBLISHED","assigner":"canonical","published_at":"2012-06-19 20:55:05","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.ubuntu.com/usn/USN-1475-1","name":"http://www.ubuntu.com/usn/USN-1475-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-1475-1: APT update | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/54046","name":"http://www.securityfocus.com/bid/54046","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639","name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug #1013639 “net-update verifcation checking is still insecure ...” : Bugs : “apt” package : Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1477-1","name":"http://www.ubuntu.com/usn/USN-1477-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-1477-1: APT vulnerability | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2012/Jun/267","name":"http://seclists.org/fulldisclosure/2012/Jun/267","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Strange gpg key shadowing","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128","name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug #1013128 “gpg key shadowing” : Bugs : “apt” package : Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2012/Jun/271","name":"http://seclists.org/fulldisclosure/2012/Jun/271","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Using second gpg keyring may be misleading?","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2012/Jun/289","name":"http://seclists.org/fulldisclosure/2012/Jun/289","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: ubuntu apt-key (part 3)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681","name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug #1013681 “make apt-key net-update secure” : Bugs : “apt” package : Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0954","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0954","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.15","cpe7":"exp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.15","cpe7":"exp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.15","cpe7":"exp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.17","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.17","cpe7":"exp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.17","cpe7":"exp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.17","cpe7":"exp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.17","cpe7":"exp4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.18","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.19","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.2-0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.20.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.20.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.22","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.22.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.22.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.23","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.23.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.7.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.0","cpe7":"pre1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.0","cpe7":"pre2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.10.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.10.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.10.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.11.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.13.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.13.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.14.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15","cpe7":"exp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15","cpe7":"exp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15","cpe7":"exp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"debian","cpe5":"advanced_package_tool","cpe6":"0.8.15.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T18:45:26.017Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20120614 Using second gpg keyring may be misleading?","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2012/Jun/271"},{"name":"54046","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/54046"},{"name":"20120612 Strange gpg key shadowing","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2012/Jun/267"},{"name":"USN-1477-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1477-1"},{"name":"USN-1475-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1475-1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639"},{"name":"20120615 ubuntu apt-key (part 3)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2012/Jun/289"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2012-06-19T20:00:00.000Z","orgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","shortName":"canonical"},"references":[{"name":"20120614 Using second gpg keyring may be misleading?","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2012/Jun/271"},{"name":"54046","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/54046"},{"name":"20120612 Strange gpg key shadowing","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2012/Jun/267"},{"name":"USN-1477-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1477-1"},{"name":"USN-1475-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1475-1"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639"},{"name":"20120615 ubuntu apt-key (part 3)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2012/Jun/289"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@ubuntu.com","ID":"CVE-2012-0954","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20120614 Using second gpg keyring may be misleading?","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2012/Jun/271"},{"name":"54046","refsource":"BID","url":"http://www.securityfocus.com/bid/54046"},{"name":"20120612 Strange gpg key shadowing","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2012/Jun/267"},{"name":"USN-1477-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1477-1"},{"name":"USN-1475-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1475-1"},{"name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128","refsource":"CONFIRM","url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128"},{"name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639","refsource":"CONFIRM","url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639"},{"name":"20120615 ubuntu apt-key (part 3)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2012/Jun/289"},{"name":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681","refsource":"CONFIRM","url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681"}]}}}},"cveMetadata":{"assignerOrgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","assignerShortName":"canonical","cveId":"CVE-2012-0954","datePublished":"2012-06-19T20:00:00.000Z","dateReserved":"2012-02-01T00:00:00.000Z","dateUpdated":"2024-09-16T20:13:26.664Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-06-19 20:55:05","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.0:*:*:*:*:*:*:*","matchCriteriaId":"2372DE68-69A3-44B6-A42E-1C8EA272FAC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.1:*:*:*:*:*:*:*","matchCriteriaId":"1F846A10-711A-42A1-A71A-FB11D4B511F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.2:*:*:*:*:*:*:*","matchCriteriaId":"3E070DA8-E764-4C1B-BCDB-F15597ABE7AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.2-0.1:*:*:*:*:*:*:*","matchCriteriaId":"DCEE6BF2-3B33-41F7-84C4-626D1559FB24"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.10:*:*:*:*:*:*:*","matchCriteriaId":"1BDAAE90-9BD4-4160-89D3-162561CB30BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.11:*:*:*:*:*:*:*","matchCriteriaId":"CBC7B0DD-F983-41DC-BB78-52FB53C044DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.12:*:*:*:*:*:*:*","matchCriteriaId":"B832BF3E-A081-4708-8D54-C5BC827965E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.13:*:*:*:*:*:*:*","matchCriteriaId":"31586872-C049-4125-B82A-FEA8B06FDF7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.14:*:*:*:*:*:*:*","matchCriteriaId":"2F377D69-4C1D-4D1A-96D9-B7724756CA3D"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.15:*:*:*:*:*:*:*","matchCriteriaId":"71851F90-85E4-4250-B9FB-320A33B04B58"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp1:*:*:*:*:*:*","matchCriteriaId":"C6356166-F4D5-4B50-94AE-7A25803FFF38"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp2:*:*:*:*:*:*","matchCriteriaId":"0D7D88AF-16B4-4C3F-AF7D-8773CB08BA01"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp3:*:*:*:*:*:*","matchCriteriaId":"5F293909-BFDB-49A2-AF03-6ADACE195204"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.16:*:*:*:*:*:*:*","matchCriteriaId":"E138D3A7-F289-4491-A24D-4DF2F179EAAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.17:*:*:*:*:*:*:*","matchCriteriaId":"19ED89FC-F907-4126-B969-625887306487"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp1:*:*:*:*:*:*","matchCriteriaId":"0F467E33-20AC-401C-AF1F-8F4BC0CB0C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp2:*:*:*:*:*:*","matchCriteriaId":"595406A6-DFD2-4E26-82C8-745E0AC0D6B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp3:*:*:*:*:*:*","matchCriteriaId":"4ED3DB0F-E9BF-4E23-8057-AACA17475C66"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp4:*:*:*:*:*:*","matchCriteriaId":"39A7A479-6225-43EA-B010-46EF4BC77E10"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.18:*:*:*:*:*:*:*","matchCriteriaId":"9EC4CC2E-7E68-4360-8360-B0463D9B6B79"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.19:*:*:*:*:*:*:*","matchCriteriaId":"BF988A0E-A630-40DD-9387-2C1610D2F932"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.20:*:*:*:*:*:*:*","matchCriteriaId":"63E05BE6-9BDF-441E-873E-A4D965B3494F"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.20.1:*:*:*:*:*:*:*","matchCriteriaId":"EBE7EC9A-2E4D-4A60-AC88-F390F5B3432A"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.20.2:*:*:*:*:*:*:*","matchCriteriaId":"A2257DAB-0A44-4841-9EF9-CBBF9BB68F40"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.21:*:*:*:*:*:*:*","matchCriteriaId":"47EDE750-C502-4B25-829D-D0C0F2653C19"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.22:*:*:*:*:*:*:*","matchCriteriaId":"189E20DE-EEFB-488A-B741-4BC80CF553B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.22.1:*:*:*:*:*:*:*","matchCriteriaId":"96D80D63-6971-4CC7-A9A8-D9D05767F60A"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.22.2:*:*:*:*:*:*:*","matchCriteriaId":"1186DDDE-FCF4-45B8-A7EA-2DAE8DA3F010"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.23:*:*:*:*:*:*:*","matchCriteriaId":"58F88656-5BF9-4D51-9C37-26E9685484F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.23.1:*:*:*:*:*:*:*","matchCriteriaId":"9AB74135-2BB7-42F7-99CB-AFF0B811B66A"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.7.24:*:*:*:*:*:*:*","matchCriteriaId":"1B025168-8319-45C2-82BC-97EBD5EE563E"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.0:*:*:*:*:*:*:*","matchCriteriaId":"58F0D8BF-F9D3-40D0-AD71-9978F2A1FD29"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre1:*:*:*:*:*:*","matchCriteriaId":"E82F9BF7-D4DD-4CF5-BE57-4772B7DDD5D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre2:*:*:*:*:*:*","matchCriteriaId":"7F4BC141-EEEB-4D0B-A3D4-24929855B685"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.1:*:*:*:*:*:*:*","matchCriteriaId":"6CA54D7A-9296-4530-8215-6EB708DDE2B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.10:*:*:*:*:*:*:*","matchCriteriaId":"04F345BE-745C-418D-BF0F-B7A5F1E3A5B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.10.1:*:*:*:*:*:*:*","matchCriteriaId":"46799DD7-E46E-4EB2-AF13-852407384A5C"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.10.2:*:*:*:*:*:*:*","matchCriteriaId":"C417AF8F-D12C-4759-B99D-C60E139B9946"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.10.3:*:*:*:*:*:*:*","matchCriteriaId":"225275E2-3E9E-48FE-A2FF-9FE37A67E550"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11:*:*:*:*:*:*:*","matchCriteriaId":"3EA2183D-7D9E-4841-A1C9-B843AF3A03F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11.1:*:*:*:*:*:*:*","matchCriteriaId":"7EAB3B8A-BDFA-4EDD-9A6D-F3CDE4977EDD"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11.2:*:*:*:*:*:*:*","matchCriteriaId":"7A629D58-017D-4F27-B286-42094C727822"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11.3:*:*:*:*:*:*:*","matchCriteriaId":"9817661D-CACE-4D81-9432-2CDE5A51F4DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11.4:*:*:*:*:*:*:*","matchCriteriaId":"A1A65066-5A1A-4091-9219-6060A662653D"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.11.5:*:*:*:*:*:*:*","matchCriteriaId":"FAFCA592-F57F-4C12-A1F7-496BDFB2A4A3"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.12:*:*:*:*:*:*:*","matchCriteriaId":"9793E4BB-5969-45DB-B9F6-29CB9C98D559"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.13:*:*:*:*:*:*:*","matchCriteriaId":"7427F24E-D3CB-498E-8695-9FC40546CFA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.13.1:*:*:*:*:*:*:*","matchCriteriaId":"70A8FE33-63BC-4145-A6CA-90A61CB81AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.13.2:*:*:*:*:*:*:*","matchCriteriaId":"08C018A3-012C-4790-9D09-36661549A6E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.14:*:*:*:*:*:*:*","matchCriteriaId":"406C6D95-53B7-4950-83C5-4C27E755F24A"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.14.1:*:*:*:*:*:*:*","matchCriteriaId":"F0E56161-E80F-4EC4-9D1C-0FBCA672EEFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15:*:*:*:*:*:*:*","matchCriteriaId":"64C1D283-9326-4A6E-9529-BA8D26A36CE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp1:*:*:*:*:*:*","matchCriteriaId":"1784FE65-DAE2-4E97-96A3-9A1835040245"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp2:*:*:*:*:*:*","matchCriteriaId":"6368BAB5-D44D-42B3-B5F7-E343E1101CDF"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp3:*:*:*:*:*:*","matchCriteriaId":"F2D3D5D9-97D1-44C6-B3BE-C9CFC1451FD6"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.1:*:*:*:*:*:*:*","matchCriteriaId":"3F5C252C-76F7-492F-AFFB-3BE2A63EE22E"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.6:*:*:*:*:*:*:*","matchCriteriaId":"233F5902-0AF1-4417-8C97-34C9B64C09AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.7:*:*:*:*:*:*:*","matchCriteriaId":"5D613D7E-4456-4F47-9F13-F5D746F8715B"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.8:*:*:*:*:*:*:*","matchCriteriaId":"6DBD6821-E6C3-4F76-89C9-19478D8EB13A"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.9:*:*:*:*:*:*:*","matchCriteriaId":"2E7D4F82-45B9-4FC9-85C5-3F5E3966A243"},{"vulnerable":true,"criteria":"cpe:2.3:a:debian:advanced_package_tool:0.8.15.10:*:*:*:*:*:*:*","matchCriteriaId":"475F9461-71F5-4E01-9399-E0413390A423"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"954","Ordinal":"1","Title":"CVE-2012-0954","CVE":"CVE-2012-0954","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"954","Ordinal":"1","NoteData":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.","Type":"Description","Title":"CVE-2012-0954"},{"CveYear":"2012","CveId":"954","Ordinal":"2","NoteData":"2012-06-19","Type":"Other","Title":"Published"}]}}}