CVE-2012-0955— software-properties incorrectly validated TLS certificates
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2012-0955
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
software-properties incorrectly validated TLS certificates
Source: NVD (National Vulnerability Database)
Vulnerability Description
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Launchpad Software-properties 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Launchpad Software-properties是Launchpad组织的一个用于管理Linux系统中安装软件镜像的一个软件。 software-properties 0.92之前版本存在安全漏洞，该漏洞源于在softwareproperties ppa.py中不正确的TLS证书验证，软件属性容易受到中间人攻击。software-properties不检查python2下的TLS证书，只检查python3下的证书，如果提供了一个有效的证书包。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Canonical | software-properties | 0.92 ~ 0.92 | - |
II. Public POCs for CVE-2012-0955
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2012-0955
请登录查看更多情报信息。
- https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753vendor-advisoryx_refsource_UBUNTU
- https://nvd.nist.gov/vuln/detail/CVE-2012-0955
IV. Related Vulnerabilities
Same vendor: Canonical
- CVE-2026-6970
authd Denial of Service and Local Privilege Escalation - CVE-2026-6369
Exposed Session Token in canonical-livepatch client snap - CVE-2026-5412
Juju CloudSpec API could leak senstive information - CVE-2026-5774
Juju API Server Denial of Service and Authentication Replay - CVE-2025-14551
Senstive information disclosure was affecting subiquity
Same weakness: CWE-295
V. Comments for CVE-2012-0955
No comments yet