CVE-2011-3634
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails...
CVE-2011-3634 is a low vulnerability (CVSS 2.6) in Canonical Ubuntu Linux, published February 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in apt 0.8.11.
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
CVE-2011-3634- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
CVE-2011-3634- Updated
- 2026-11-02
EUVDEUVD-2011-3593 No score
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
EUVD-2011-3593- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rgc6-vjp8-p4rv No score
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails...
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
GHSA-rgc6-vjp8-p4rv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
CVE-2011-3634- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3634 No score
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
- Record
DEBIAN-CVE-2011-3634- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
ubuntu.com/usn/USN-1283-1
alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD
people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html
bugs.launchpad.net/ubuntu/+source/apt/+bug/868353
nvd.nist.gov/vuln/detail/CVE-2011-3634
github.com/advisories/GHSA-rgc6-vjp8-p4rv
security-tracker.debian.org/tracker/CVE-2011-3634