PT-2020-5441 · Canonical+2 · Add-Apt-Repository+3

Published 2020-08-03 · Updated 2020-09-16 · CVE-2020-15709

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions add-apt-repository versions prior to 0.98.9.2 add-apt-repository versions prior to 0.96.24.32.14 add-apt-repository versions prior to 0.96.20.10 add-apt-repository versions prior to 0.92.37.8ubuntu0.1~esm1

Description The issue arises due to insufficient input validation in the add-apt-repository utility, allowing PPA owners to provide ANSI terminal escapes. This could modify terminal contents in unexpected ways, potentially compromising the integrity of protected information.

Recommendations For versions prior to 0.98.9.2, update to version 0.98.9.2 or later. For versions prior to 0.96.24.32.14, update to version 0.96.24.32.14 or later. For versions prior to 0.96.20.10, update to version 0.96.20.10 or later. For versions prior to 0.92.37.8ubuntu0.1esm1, update to version 0.92.37.8ubuntu0.1esm1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-00562

CVE-2020-15709

DLA-2339-1

USN-4457-1

USN-4457-2

Affected Products

Debian

Linuxmint

Ubuntu

Add-Apt-Repository

References · 15

• https://cve.org/CVERecord?id=CVE-2020-15709 · Security Note
• https://osv.dev/vulnerability/USN-4457-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15709 · Vendor Advisory
• https://git.launchpad.net/software-properties/commit/add-apt-repository?id=97e2fe7d181e8711e0f5253d3b8db40426c17f1e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15709 · Security Note
• https://ubuntu.com/security/notices/USN-4457-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15709 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15709 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4457-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4457-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15709 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00562 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15709 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2339-1 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/08/03/1 · Note