APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to…
Priority LOW 17CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
Why it matters now
EPSS 0.01685 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:advanced_package_tool:0.7.0:*:*:*:*:*:*:* | 0.7.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.1:*:*:*:*:*:*:* | 0.7.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.2:*:*:*:*:*:*:* | 0.7.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.2-0.1:*:*:*:*:*:*:* | 0.7.2-0.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.10:*:*:*:*:*:*:* | 0.7.10 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.11:*:*:*:*:*:*:* | 0.7.11 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.12:*:*:*:*:*:*:* | 0.7.12 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.13:*:*:*:*:*:*:* | 0.7.13 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.14:*:*:*:*:*:*:* | 0.7.14 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.15:*:*:*:*:*:*:* | 0.7.15 | Vulnerable | Debian |
- cpe:2.3:a:debian:advanced_package_tool:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.2-0.1:*:*:*:*:*:*:* Versions 0.7.2-0.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.10:*:*:*:*:*:*:* Versions 0.7.10 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.11:*:*:*:*:*:*:* Versions 0.7.11 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.12:*:*:*:*:*:*:* Versions 0.7.12 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.13:*:*:*:*:*:*:* Versions 0.7.13 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.14:*:*:*:*:*:*:* Versions 0.7.14 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.15:*:*:*:*:*:*:* Versions 0.7.15 Vulnerable ·Debian
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp1:*:*:*:*:*:* | 0.7.15 exp1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp2:*:*:*:*:*:* | 0.7.15 exp2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp3:*:*:*:*:*:* | 0.7.15 exp3 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.16:*:*:*:*:*:*:* | 0.7.16 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.17:*:*:*:*:*:*:* | 0.7.17 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp1:*:*:*:*:*:* | 0.7.17 exp1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp2:*:*:*:*:*:* | 0.7.17 exp2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp3:*:*:*:*:*:* | 0.7.17 exp3 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp4:*:*:*:*:*:* | 0.7.17 exp4 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.18:*:*:*:*:*:*:* | 0.7.18 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.19:*:*:*:*:*:*:* | 0.7.19 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.20:*:*:*:*:*:*:* | 0.7.20 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.20.1:*:*:*:*:*:*:* | 0.7.20.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.20.2:*:*:*:*:*:*:* | 0.7.20.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.21:*:*:*:*:*:*:* | 0.7.21 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.22:*:*:*:*:*:*:* | 0.7.22 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.22.1:*:*:*:*:*:*:* | 0.7.22.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.22.2:*:*:*:*:*:*:* | 0.7.22.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.23:*:*:*:*:*:*:* | 0.7.23 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.23.1:*:*:*:*:*:*:* | 0.7.23.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.7.24:*:*:*:*:*:*:* | 0.7.24 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:*:*:*:*:*:*:* | 0.8.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre1:*:*:*:*:*:* | 0.8.0 pre1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre2:*:*:*:*:*:* | 0.8.0 pre2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.1:*:*:*:*:*:*:* | 0.8.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.10:*:*:*:*:*:*:* | 0.8.10 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.10.1:*:*:*:*:*:*:* | 0.8.10.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.10.2:*:*:*:*:*:*:* | 0.8.10.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.10.3:*:*:*:*:*:*:* | 0.8.10.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11:*:*:*:*:*:*:* | 0.8.11 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11.1:*:*:*:*:*:*:* | 0.8.11.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11.2:*:*:*:*:*:*:* | 0.8.11.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11.3:*:*:*:*:*:*:* | 0.8.11.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11.4:*:*:*:*:*:*:* | 0.8.11.4 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.11.5:*:*:*:*:*:*:* | 0.8.11.5 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.12:*:*:*:*:*:*:* | 0.8.12 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.13:*:*:*:*:*:*:* | 0.8.13 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.13.1:*:*:*:*:*:*:* | 0.8.13.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.13.2:*:*:*:*:*:*:* | 0.8.13.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.14:*:*:*:*:*:*:* | 0.8.14 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.14.1:*:*:*:*:*:*:* | 0.8.14.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15:*:*:*:*:*:*:* | 0.8.15 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp1:*:*:*:*:*:* | 0.8.15 exp1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp2:*:*:*:*:*:* | 0.8.15 exp2 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp3:*:*:*:*:*:* | 0.8.15 exp3 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.1:*:*:*:*:*:*:* | 0.8.15.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.6:*:*:*:*:*:*:* | 0.8.15.6 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.7:*:*:*:*:*:*:* | 0.8.15.7 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.8:*:*:*:*:*:*:* | 0.8.15.8 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.9:*:*:*:*:*:*:* | 0.8.15.9 | Vulnerable | Debian |
| cpe:2.3:a:debian:advanced_package_tool:0.8.15.10:*:*:*:*:*:*:* | 0.8.15.10 | Vulnerable | Debian |
- cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp1:*:*:*:*:*:* Versions 0.7.15 exp1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp2:*:*:*:*:*:* Versions 0.7.15 exp2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.15:exp3:*:*:*:*:*:* Versions 0.7.15 exp3 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.16:*:*:*:*:*:*:* Versions 0.7.16 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.17:*:*:*:*:*:*:* Versions 0.7.17 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp1:*:*:*:*:*:* Versions 0.7.17 exp1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp2:*:*:*:*:*:* Versions 0.7.17 exp2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp3:*:*:*:*:*:* Versions 0.7.17 exp3 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.17:exp4:*:*:*:*:*:* Versions 0.7.17 exp4 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.18:*:*:*:*:*:*:* Versions 0.7.18 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.19:*:*:*:*:*:*:* Versions 0.7.19 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.20:*:*:*:*:*:*:* Versions 0.7.20 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.20.1:*:*:*:*:*:*:* Versions 0.7.20.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.20.2:*:*:*:*:*:*:* Versions 0.7.20.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.21:*:*:*:*:*:*:* Versions 0.7.21 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.22:*:*:*:*:*:*:* Versions 0.7.22 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.22.1:*:*:*:*:*:*:* Versions 0.7.22.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.22.2:*:*:*:*:*:*:* Versions 0.7.22.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.23:*:*:*:*:*:*:* Versions 0.7.23 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.23.1:*:*:*:*:*:*:* Versions 0.7.23.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.7.24:*:*:*:*:*:*:* Versions 0.7.24 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre1:*:*:*:*:*:* Versions 0.8.0 pre1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.0:pre2:*:*:*:*:*:* Versions 0.8.0 pre2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.10:*:*:*:*:*:*:* Versions 0.8.10 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.10.1:*:*:*:*:*:*:* Versions 0.8.10.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.10.2:*:*:*:*:*:*:* Versions 0.8.10.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.10.3:*:*:*:*:*:*:* Versions 0.8.10.3 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11:*:*:*:*:*:*:* Versions 0.8.11 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11.1:*:*:*:*:*:*:* Versions 0.8.11.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11.2:*:*:*:*:*:*:* Versions 0.8.11.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11.3:*:*:*:*:*:*:* Versions 0.8.11.3 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11.4:*:*:*:*:*:*:* Versions 0.8.11.4 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.11.5:*:*:*:*:*:*:* Versions 0.8.11.5 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.12:*:*:*:*:*:*:* Versions 0.8.12 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.13:*:*:*:*:*:*:* Versions 0.8.13 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.13.1:*:*:*:*:*:*:* Versions 0.8.13.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.13.2:*:*:*:*:*:*:* Versions 0.8.13.2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.14:*:*:*:*:*:*:* Versions 0.8.14 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.14.1:*:*:*:*:*:*:* Versions 0.8.14.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15:*:*:*:*:*:*:* Versions 0.8.15 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp1:*:*:*:*:*:* Versions 0.8.15 exp1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp2:*:*:*:*:*:* Versions 0.8.15 exp2 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15:exp3:*:*:*:*:*:* Versions 0.8.15 exp3 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.1:*:*:*:*:*:*:* Versions 0.8.15.1 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.6:*:*:*:*:*:*:* Versions 0.8.15.6 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.7:*:*:*:*:*:*:* Versions 0.8.15.7 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.8:*:*:*:*:*:*:* Versions 0.8.15.8 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.9:*:*:*:*:*:*:* Versions 0.8.15.9 Vulnerable ·Debian
- cpe:2.3:a:debian:advanced_package_tool:0.8.15.10:*:*:*:*:*:*:* Versions 0.8.15.10 Vulnerable ·Debian
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3587
- 2026-10-03 Alias added: GHSA-2c4h-r267-mgv3
References
More Debian Advanced Package Tool vulnerabilities
- TI-2019-02590 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions… CVSS 3.1HIGH 8.1
- TI-2009-01292 apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which… CVSS 2.0HIGH 10.0
- TI-2009-01235 apt 0.7.20 does not check when the date command returns an "invalid date" error, which… CVSS 2.0HIGH 10.0
- TI-2014-00469 The apt-get download command in APT before 1.0.9 does not properly validate signatures… CVSS 2.0HIGH 7.5
- TI-2014-00468 APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate… CVSS 2.0HIGH 7.5
- TI-2016-01149 The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2012-3587 · CVE Program
- CVE-2012-3587 · NVD
- FIRST EPSS
- GHSA-2c4h-r267-mgv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences