CVE-2012-3587

CVE-2012-3587 describes a man-in-the-middle vulnerability in APT versions 0.7.x before 0.7.25 and 0.8.x before 0.8.16, specifically when using the apt-key net-update function to import keyrings. The flaw stems from APT's reliance on GnuPG argument order and its failure to properly check GPG subkeys, potentially allowing remote attackers to install malicious "Trojan horse" packages. This vulnerability has a low CVSS score of 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), indicating a network-based attack with high attack complexity, no authentication required, and a potential impact of partial integrity compromise. While it could lead to the installation of unauthorized software, there is no impact on confidentiality or availability. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.