PT-2020-2104 · Canonical · Python-Apt+1
Published
2020-01-20
·
Updated
2022-05-24
·
CVE-2019-15796
CVSS v3.1
4.7
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
python-apt versions 1.9.3ubuntu2 and earlier
Description
The issue is related to the functions
Version.fetch binary() and Version.fetch source() in the python-apt module, which fails to check if hashes are signed when loading files from repositories. This allows downloads from unsigned repositories, potentially compromising data integrity. The problem has been fixed in versions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.Recommendations
For python-apt versions 1.9.3ubuntu2 and earlier, update to version 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, or 0.8.3ubuntu7.5 to resolve the issue.
As a temporary workaround, consider disabling the
Version.fetch binary() and Version.fetch source() functions until a patch is available.
Restrict access to unsigned repositories to minimize the risk of exploitation.Fix
Improper Authentication
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ubuntu
Python-Apt