Read the docs
TI-2012-00879 Aliases CVE-2012-0955GHSA-47v9-xw5c-g56f

software-properties incorrectly validated TLS certificates

Priority LOW 33CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.

Why it matters now

EPSS 0.00615 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed software-properties (Canonical): 0.92

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalsoftware-properties0.92 to before 0.920.92Patch availableCNA
  • software-properties VendorCanonical Affected 0.92 to before 0.92 Fixed in 0.92 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:software-properties:*:*:*:*:*:*:*:*before 0.92VulnerableCanonical
  • cpe:2.3:a:canonical:software-properties:*:*:*:*:*:*:*:* Versions before 0.92 Vulnerable ·Canonical

Remediation

  • Fix · CNA software-properties (Canonical) Fixed in 0.92

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0955
  2. 2026-10-03 Alias added: GHSA-47v9-xw5c-g56f

References

Exploit 1

Patch 1

  • TI-2011-03841 ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences