{"id":"CVE-2011-4407","details":"ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.","modified":"2026-04-10T03:42:05.619747Z","published":"2014-05-14T00:55:04Z","references":[{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-1352-1"},{"type":"WEB","url":"https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210"}],"schema_version":"1.7.5"}