{"id":"CVE-2012-0955","aliases":["DEBIAN-CVE-2012-0955","EUVD-2012-0978","GHSA-47v9-xw5c-g56f"],"status":"published","title":"software-properties incorrectly validated TLS certificates","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00615,"percentile":0.49714,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-12-02T00:50:15Z","modified":"2026-10-23T18:02:09Z","fixes":[{"ecosystem":"Debian:12","package":"software-properties","fixed_in":["0.92.25debian1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92.25debian1"}]}]}],"products":[{"vendor":"canonical","product":"software-properties"}],"references":[{"url":"https://launchpad.net/bugs/1036839","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0955"},{"url":"https://github.com/advisories/GHSA-47v9-xw5c-g56f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-0955","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-0955","title":"software-properties incorrectly validated TLS certificates","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2020-12-02T00:50:15.305Z","modified":"2024-09-16T17:14:04.258Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:52.638543Z"}],"euvd":[{"id":"EUVD-2012-0978","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2020-12-02T00:50:15Z","modified":"2024-09-16T17:14:04Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:44.31512Z"}],"ghsa":[{"id":"GHSA-47v9-xw5c-g56f","title":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS...","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2022-04-23T00:40:50Z","modified":"2023-01-27T05:02:06Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:42:01.451226Z"}],"nvd":[{"id":"CVE-2012-0955","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2020-12-02T01:15:11.797Z","modified":"2026-06-16T23:38:34.43Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:02:18.043773Z"}],"osv":[{"id":"CVE-2012-0955","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2020-12-02T01:15:11Z","modified":"2026-04-10T03:42:13.102854Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-0955","description":"software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.","status":"published","published":"2020-12-02T01:15:11.797Z","modified":"2026-10-23T18:02:09.701966953Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:24.92418Z"}]}}