python-apt downloads from untrusted sources
CVE-2019-15796

4.7MEDIUM

Key Information:

Vendor
Canonical
Status
Python-apt
Vendor
CVE Published:
26 March 2020

Summary

Python-apt doesn't check if hashes are signed in Version.fetch_binary() and Version.fetch_source() of apt/package.py or in _fetch_archives() of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Affected Version(s)

Python-apt 0.8.3 < 0.8.3ubuntu7.5

Python-apt 0.9.3.5 < 0.9.3.5ubuntu3+esm2

Python-apt 1.1.0 < 1.1.0~beta1ubuntu0.16.04.7

References

https://usn.ubuntu.com/4247-1/
vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4247-3/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Julian Andres Klode
.