{"id":"CVE-2011-3634","aliases":["DEBIAN-CVE-2011-3634","DLA-0005-1","EUVD-2011-3593","GHSA-rgc6-vjp8-p4rv"],"status":"published","title":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails...","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","severity":{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00815,"percentile":0.57308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-02-28T18:00:00Z","modified":"2026-10-23T17:47:35Z","fixes":[{"ecosystem":"Debian:12","package":"apt","fixed_in":["0.8.11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apt","fixed_in":["0.8.11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apt","fixed_in":["0.8.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.10.3+squeeze2"}]}],"versions":["0.8.10.3","0.8.10.3+squeeze1"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"advanced_package_tool"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-1283-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3634"},{"url":"https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git;a=blob;f=debian/changelog;hb=HEAD"},{"url":"https://github.com/advisories/GHSA-rgc6-vjp8-p4rv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-3634","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-3634","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2014-02-28T18:00:00Z","modified":"2024-08-06T23:37:48.626Z","updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2011-3593","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2014-02-28T18:00:00Z","modified":"2024-08-06T23:37:48Z","updated_at":"2026-11-03T01:39:50.860626Z"}],"ghsa":[{"id":"GHSA-rgc6-vjp8-p4rv","title":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails...","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2022-05-13T01:29:03Z","modified":"2023-02-13T00:30:47Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:54:04.926808Z"}],"nvd":[{"id":"CVE-2011-3634","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2014-03-01T00:55:04.857Z","modified":"2026-06-16T23:33:39.827Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"CVE-2011-3634","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2014-03-01T00:55:04Z","modified":"2026-04-10T03:41:59.801736Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-3634","description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","status":"published","published":"2014-03-01T00:55:04.857Z","modified":"2026-10-23T17:47:35.838034038Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DLA-0005-1","title":"apt - security update","status":"published","published":"2014-06-12T00:00:00Z","modified":"2026-03-09T01:01:51.058236Z","updated_at":"2026-11-02T15:46:08.746073Z"}]}}