--- title: "CVE-2012-5356\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2012-5356?format=md keywords: index, follow --- # CVE-2012-5356 Publication date 10 October 2012 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | software-properties | 12.04 LTS precise | Fixed 0.82.7.3 | | 11.10 oneiric | Fixed 0.81.13.5 | | 11.04 natty | Fixed 0.80.9.2 | | 10.04 LTS lucid | Fixed 0.75.10.3 | | 8.04 LTS hardy | Ignored end of life | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5356) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2012-5356) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2012-5356) * [Debian](https://security-tracker.debian.org/tracker/CVE-2012-5356) ### Other references * * *