CVE-2012-0955— software-properties incorrectly validated TLS certificates
Quick assessment
Affected
Canonical software-properties
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Launchpad Software-properties是Launchpad组织的一个用于管理Linux系统中安装软件镜像的一个软件。 software-properties 0.92之前版本存在安全漏洞，该漏洞源于在softwareproperties ppa.py中不正确的TLS证书验证，软件属性容易受到中间人攻击。software-properties不检查python2下的TLS证书，只检查python3下的证书，如果提供了一个有效的证书包。
Possible ATT&CK Techniques 2 AI
T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2012-0955
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
software-properties incorrectly validated TLS certificates
Source: CVE Program / CVE List V5
Vulnerability Description
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Launchpad Software-properties 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Launchpad Software-properties是Launchpad组织的一个用于管理Linux系统中安装软件镜像的一个软件。 software-properties 0.92之前版本存在安全漏洞，该漏洞源于在softwareproperties ppa.py中不正确的TLS证书验证，软件属性容易受到中间人攻击。software-properties不检查python2下的TLS证书，只检查python3下的证书，如果提供了一个有效的证书包。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Canonical | software-properties | 0.92 ~ 0.92 | - |
|
II. Public POCs for CVE-2012-0955
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2012-0955
请登录查看更多情报信息。
Other References for CVE-2012-0955 (2)
-
-
https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753 vendor-advisory x_refsource_UBUNTU
IV. Related Vulnerabilities
Same vendor: Canonical
-
CVE-2026-66897
Instance template path traversal allows arbitrary host file -
CVE-2026-77113
Path Traversal Vulnerability in apport-unpack -
CVE-2026-61898
accountsservice: shell injection via attacker-controlled ~/. -
CVE-2026-61897
accountsservice: incomplete privilege drop when running Ubun -
CVE-2026-16033
Arbitrary file read+write on host via templates/ symlink in
Same weakness: CWE-295
-
CVE-2026-78323
Jss: jss: jsstrustmanager does not verify nss trust flags on -
CVE-2026-17024
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-53583
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Ba -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted
V. Comments for CVE-2012-0955
No comments yet