PT-2020-6227 · Canonical+1 · Python-Apt+2

Kevin Backhouse · Published 2020-12-09 · Updated 2021-01-11 · CVE-2020-27351

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions python-apt versions 1.1.0beta1 through 1.1.0beta1ubuntu0.16.04.9 python-apt versions 1.6.5ubuntu0 through 1.6.5ubuntu0.3 python-apt versions 2.0.0ubuntu0 through 2.0.0ubuntu0.20.04.1 python-apt versions 2.1.3ubuntu1 through 2.1.3ubuntu1.0

Description The issue is related to memory and file descriptor leaks found in the python-apt module, specifically in the files python/arfile.cc, python/tag.cc, and python/tarfile.cc. This can lead to a denial of service. The leaks are caused by the lack of resource release after its expiration.

Recommendations For python-apt versions 1.1.0beta1 through 1.1.0beta1ubuntu0.16.04.9, update to version 1.1.0~beta1ubuntu0.16.04.10 or later. For python-apt versions 1.6.5ubuntu0 through 1.6.5ubuntu0.3, update to version 1.6.5ubuntu0.4 or later. For python-apt versions 2.0.0ubuntu0 through 2.0.0ubuntu0.20.04.1, update to version 2.0.0ubuntu0.20.04.2 or later. For python-apt versions 2.1.3ubuntu1 through 2.1.3ubuntu1.0, update to version 2.1.3ubuntu1.1 or later.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

BDU:2021-03628

CVE-2020-27351

DLA-2488-1

DLA-2488-2

DSA-4809-1

DSA-4809-2

USN-4668-1

USN-4668-3

USN-4668-4

Affected Products

Linuxmint

Ubuntu

Python-Apt

References · 49

• https://cve.org/CVERecord?id=CVE-2020-27351 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-27351 · Security Note
• https://osv.dev/vulnerability/DSA-4809-2 · Vendor Advisory
• https://debian.org/security/2020/dsa-4809 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-27351 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4668-3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27351 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4668-4 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2488-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03628 · Security Note
• https://usn.ubuntu.com/usn/usn-4668-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4668-3 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4668-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory