python-apt uses MD5 for validation
CVE-2019-15795

4.7MEDIUM

Key Information:

Vendor
Canonical
Status
Python-apt
Vendor
CVE Published:
26 March 2020

Summary

python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Affected Version(s)

Python-apt 0.8.3 < 0.8.3ubuntu7.5

Python-apt 0.9.3.5 < 0.9.3.5ubuntu3+esm2

Python-apt 1.1.0 < 1.1.0~beta1ubuntu0.16.04.7

References

https://usn.ubuntu.com/4247-1/
vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4247-3/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Julian Andres Klode
.