CVE-2012-3587: APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, reli...

Security readout for executives and security teams

This flaw affects very old APT versions when apt-key net-update imports keyrings. A network attacker positioned between the system and key source could interfere with package trust and cause Trojan packages to be installed. The bundle does not show active exploitation or a CVSS score. Exposure is likely limited to legacy Debian or Ubuntu-derived systems using affected APT branches and the apt-key net-update workflow. Systems not using that key import path are less directly exposed based on the provided description. Treat this as high priority only where legacy APT and apt-key net-update remain in use. The business risk is package supply-chain compromise, but the likely installed base should be small in modern environments. Mitigation focus: Update APT to vendor-fixed versions: 0.7.25, 0.8.16, or later.; Review Ubuntu USN-1475-1 and USN-1477-1 for distribution package guidance.; Avoid apt-key net-update on untrusted networks until systems are updated..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.