CVE-2012-0954: APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, reli...

Security readout for executives and security teams

This is a package-trust issue in old APT versions. Under specific use of apt-key net-update, an attacker positioned on the network could potentially influence keyring import behavior and cause altered packages to be accepted. The main business concern is unauthorized software installation on legacy systems. Exposure is most likely on legacy systems running the affected APT branches and using apt-key net-update to import keyrings, especially across untrusted networks. Modern supported systems are unlikely to run these versions, but old images, appliances, and forgotten build hosts should be checked. Treat this as a legacy supply-chain hygiene issue. It is not listed as actively exploited, but compromised package trust can have high downstream impact. Prioritize finding old APT installations and removing the vulnerable workflow. Mitigation focus: Upgrade APT to fixed vendor packages or versions at least 0.7.25 or 0.8.16.; Review Ubuntu advisories USN-1475-1 and USN-1477-1 for applicable package updates.; Avoid apt-key net-update on untrusted networks until affected hosts are remediated..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.