PT-2020-6168 · Packagekit+3 · Packagekit+3

Niemimsa + 1 · Published 2020-06-04 · Updated 2022-10-21 · CVE-2020-16122

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PackageKit (affected versions not specified)

Description The issue is related to PackageKit's apt backend, which incorrectly treats all local debs as trusted. This is problematic because the apt security model relies on repository trust rather than the contents of individual files. As a result, on sites with configured PolicyKit rules, users may be able to install malicious packages. The vulnerability is associated with errors in privilege management, allowing an attacker to compromise data integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Improper Privilege Management

Weakness Enumeration

CWE-345

CWE-269

Related Identifiers

BDU:2021-03398

CVE-2020-16122

DLA-2399-1

USN-4538-1

Affected Products

Astra Linux

Linuxmint

Packagekit

Ubuntu

References · 22

• https://ubuntu.com/security/CVE-2020-16121 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-16122 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16122 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-16122 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16122 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4538-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-16122 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-16122 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4538-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03398 · Security Note