CVE-2011-3374
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the...
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
CVE-2011-3374- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE List No score
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
CVE-2011-3374- Updated
- 2026-11-02
EUVDEUVD-2011-3338 No score
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
EUVD-2011-3338- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xpxf-p5mx-cq4f
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the...
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
GHSA-xpxf-p5mx-cq4f- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
CVE-2011-3374- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3374
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
- Record
DEBIAN-CVE-2011-3374- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
All versions, plus listed versions 2.6.12.7.02.7.12.7.102.7.10+nmu1~exp1 Show 45 moreShow less2.7.10+nmu1~exp22.7.112.7.122.7.12+nmu12.7.12+nmu1~exp12.7.132.7.142.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.92.9.02.9.12.9.102.9.112.9.122.9.132.9.142.9.14+noAptKey12.9.152.9.162.9.172.9.17+exp12.9.182.9.18+exp12.9.18+exp22.9.18+exp32.9.192.9.22.9.202.9.212.9.222.9.232.9.242.9.252.9.25+exp12.9.262.9.26+exp12.9.272.9.27+exp12.9.28 |
None known |
aptDebian:13 |
All versions, plus listed versions 3.0.33.1.03.1.13.1.103.1.11 Show 19 moreShow less3.1.123.1.133.1.143.1.153.1.163.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.3.03.3.13.3.23.3.33.3.4 |
None known |
aptDebian:14 |
All versions, plus listed versions 3.0.33.1.03.1.13.1.103.1.11 Show 19 moreShow less3.1.123.1.133.1.143.1.153.1.163.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.3.03.3.13.3.23.3.33.3.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3374 is a low vulnerability (CVSS 3.7) in Apt, published November 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. No source names a fixed version.
References
security-tracker.debian.org/tracker/CVE-2011-3374
access.redhat.com/security/cve/cve-2011-3374
bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480
snyk.io/vuln/SNYK-LINUX-APT-116518
people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html
seclists.org/fulldisclosure/2011/Sep/221
ubuntu.com/security/CVE-2011-3374
nvd.nist.gov/vuln/detail/CVE-2011-3374
github.com/advisories/GHSA-xpxf-p5mx-cq4f
Left out here: 44 versions. The JSON record has them.