CVE-2012-0954

CVE-2012-0954 describes a vulnerability in APT versions 0.7.x before 0.7.25 and 0.8.x before 0.8.16, specifically when using the apt-key net-update command to import keyrings. This flaw, an incomplete fix for CVE-2012-3587, stems from APT's reliance on GnuPG argument order and its failure to check GPG subkeys. This could enable a remote attacker to install altered packages through a man-in-the-middle (MITM) attack. The vulnerability has a CVSS score of 2.6, indicating low severity with a network attack vector and high access complexity, potentially leading to partial integrity compromise (installation of altered packages) but no confidentiality or availability impact. Its EPSS score is very low, and its FAUCET Risk Score is 6/100. There is no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community attention, with no social media discussion or media coverage reported.