Aptdaemon error messages disclosed file existence to unprivileged users via dbus properties
CVE-2020-16128

3.8LOW

Key Information:

Vendor

Canonical

Status
Aptdaemon
Vendor
CVE Published:
9 December 2020

What is CVE-2020-16128?

The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu14.5.

Affected Version(s)

aptdaemon 1.1.1+bzr982-0ubuntu14 < 1.1.1+bzr982-0ubuntu14.5

aptdaemon 1.1.1+bzr982-0ubuntu19 < 1.1.1+bzr982-0ubuntu19.5

aptdaemon 1.1.1+bzr982-0ubuntu32 < 1.1.1+bzr982-0ubuntu32.3

References

https://usn.ubuntu.com/usn/usn-4664-1
x_refsource_MISC
https://bugs.launchpad.net/ubuntu/+source/aptdaemon/+bug/...
x_refsource_MISC

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kevin Backhouse
.