CVE-2011-3374

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the...

3.7 Low

CVE-2011-3374 is a low vulnerability (CVSS 3.7) in Apt, published November 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. No source names a fixed version.

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.19%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 3.7

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: CVE-2011-3374
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-347
Updated: 2026-11-02

CVE List No score

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: CVE-2011-3374
Updated: 2026-11-02

EUVDEUVD-2011-3338 No score

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: EUVD-2011-3338
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xpxf-p5mx-cq4f 3.7

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the...

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: GHSA-xpxf-p5mx-cq4f
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-347
Updated: 2026-11-02

OSV 3.7

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: CVE-2011-3374
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-3374 3.7

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

Record: DEBIAN-CVE-2011-3374
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apt` Debian:12	All versions, plus listed versions 2.6.12.7.02.7.12.7.102.7.10+nmu1~exp1 Show 45 moreShow less 2.7.10+nmu1~exp22.7.112.7.122.7.12+nmu12.7.12+nmu1~exp12.7.132.7.142.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.92.9.02.9.12.9.102.9.112.9.122.9.132.9.142.9.14+noAptKey12.9.152.9.162.9.172.9.17+exp12.9.182.9.18+exp12.9.18+exp22.9.18+exp32.9.192.9.22.9.202.9.212.9.222.9.232.9.242.9.252.9.25+exp12.9.262.9.26+exp12.9.272.9.27+exp12.9.28	None known
`apt` Debian:13	All versions, plus listed versions 3.0.33.1.03.1.13.1.103.1.11 Show 19 moreShow less 3.1.123.1.133.1.143.1.153.1.163.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.3.03.3.13.3.23.3.33.3.4	None known
`apt` Debian:14	All versions, plus listed versions 3.0.33.1.03.1.13.1.103.1.11 Show 19 moreShow less 3.1.123.1.133.1.143.1.153.1.163.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.3.03.3.13.3.23.3.33.3.4	None known

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 44 versions. The JSON record has them.