CVE-2012-5356

CVE-2012-5356 describes a vulnerability in the apt-add-repository tool within Ubuntu Software Properties versions 0.75.x, 0.80.x, 0.81.x, 0.82.x, and 0.92.x. The flaw lies in its insufficient validation of PPA GPG keys imported from a keyserver. This allows a remote attacker to conduct a man-in-the-middle (MITM) attack, enabling them to install arbitrary package repository GPG keys. The vulnerability has a CVSS score of 5.8, indicating a medium severity. It can be exploited remotely with medium attack complexity, potentially leading to partial integrity and availability impacts. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.