Lucene search

[email protected]CVE-2019-15796

HistoryMar 26, 2020 - 1:15 p.m.

CVE-2019-15796

2020-03-2613:15:12

CWE-287

CWE-347

[email protected]

web.nvd.nist.gov

cve-2019-15796

python-apt

security vulnerability

unsigned repositories

version 1.9.3ubuntu2

nvd

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.7%

JSON

Python-apt doesn’t check if hashes are signed in Version.fetch_binary() and Version.fetch_source() of apt/package.py or in _fetch_archives() of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn’t be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Affected configurations

NVD

Node

ubuntupython-aptMatch0.8.0ubuntu9

ubuntupython-aptMatch0.8.1ubuntu1

ubuntupython-aptMatch0.8.3ubuntu1

ubuntupython-aptMatch0.8.3ubuntu2

ubuntupython-aptMatch0.8.3ubuntu3

ubuntupython-aptMatch0.8.3ubuntu4

ubuntupython-aptMatch0.8.3ubuntu5

ubuntupython-aptMatch0.8.3ubuntu6

ubuntupython-aptMatch0.8.3ubuntu7

ubuntupython-aptMatch0.8.3ubuntu7.1

ubuntupython-aptMatch0.8.3ubuntu7.2

ubuntupython-aptMatch0.8.3ubuntu7.3

AND

canonicalubuntu_linuxMatch12.04esm

Node

ubuntupython-aptMatch0.8.9.1

ubuntupython-aptMatch0.8.9.1ubuntu1

ubuntupython-aptMatch0.9.0

ubuntupython-aptMatch0.9.1

ubuntupython-aptMatch0.9.1build1

ubuntupython-aptMatch0.9.1build2

ubuntupython-aptMatch0.9.1ubuntu1

ubuntupython-aptMatch0.9.3.1

ubuntupython-aptMatch0.9.3.2

ubuntupython-aptMatch0.9.3.2ubuntu1

ubuntupython-aptMatch0.9.3.2ubuntu2

ubuntupython-aptMatch0.9.3.3

ubuntupython-aptMatch0.9.3.3ubuntu1

ubuntupython-aptMatch0.9.3.4

ubuntupython-aptMatch0.9.3.4build1

ubuntupython-aptMatch0.9.3.5

ubuntupython-aptMatch0.9.3.5ubuntu1

ubuntupython-aptMatch0.9.3.5ubuntu2

ubuntupython-aptMatch0.9.3.5ubuntu3

AND

canonicalubuntu_linuxMatch14.04esm

Node

ubuntupython-aptMatch1.0.1build1

ubuntupython-aptMatch1.0.1ubuntu1

ubuntupython-aptMatch1.0.1ubuntu2

ubuntupython-aptMatch1.1.0beta1

ubuntupython-aptMatch1.1.0beta1build1

ubuntupython-aptMatch1.1.0beta1ubuntu0.16.04.1

ubuntupython-aptMatch1.1.0beta1ubuntu0.16.04.2

ubuntupython-aptMatch1.1.0beta1ubuntu0.16.04.3

ubuntupython-aptMatch1.1.0beta1ubuntu0.16.04.4

ubuntupython-aptMatch1.1.0beta1ubuntu0.16.04.5

AND

canonicalubuntu_linuxMatch16.04lts

Node

debianpython-aptMatch1.8.4

ubuntupython-aptMatch1.4.0

ubuntupython-aptMatch1.4.0beta3build2

ubuntupython-aptMatch1.4.0beta3ubuntu1

ubuntupython-aptMatch1.6.0

ubuntupython-aptMatch1.6.0rc1

ubuntupython-aptMatch1.6.0rc2ubuntu1

ubuntupython-aptMatch1.6.0rc2ubuntu2

ubuntupython-aptMatch1.6.0rc3

ubuntupython-aptMatch1.6.1

ubuntupython-aptMatch1.6.2

ubuntupython-aptMatch1.6.3

ubuntupython-aptMatch1.6.3ubuntu1

ubuntupython-aptMatch1.6.4

ubuntupython-aptMatch1.8.4

AND

canonicalubuntu_linuxMatch18.04lts

Node

ubuntupython-aptMatch1.8.4

ubuntupython-aptMatch1.9.0alpha0\~ubuntu1

ubuntupython-aptMatch1.9.0alpha0\~ubuntu2

ubuntupython-aptMatch1.9.0ubuntu1

AND

canonicalubuntu_linuxMatch19.10

Node

ubuntupython-aptMatch1.7.0

ubuntupython-aptMatch1.8.0

ubuntupython-aptMatch1.8.0alpha0\~ubuntu1

ubuntupython-aptMatch1.8.0alpha0\~ubuntu2

ubuntupython-aptMatch1.8.1

ubuntupython-aptMatch1.8.2

ubuntupython-aptMatch1.8.3

ubuntupython-aptMatch1.8.4

AND

canonicalubuntu_linuxMatch19.04

CPENameOperatorVersion
ubuntu:python-aptubuntu python-apteq0.8.0
ubuntu:python-aptubuntu python-apteq0.8.1
ubuntu:python-aptubuntu python-apteq0.8.3

CPE	Name	Operator	Version
ubuntu:python-apt	ubuntu python-apt	eq	0.8.0
ubuntu:python-apt	ubuntu python-apt	eq	0.8.1
ubuntu:python-apt	ubuntu python-apt	eq	0.8.3

CNA Affected

[
  {
    "product": "Python-apt",
    "vendor": "Canonical",
    "versions": [
      {
        "lessThan": "0.8.3ubuntu7.5",
        "status": "affected",
        "version": "0.8.3",
        "versionType": "custom"
      },
      {
        "lessThan": "0.9.3.5ubuntu3+esm2",
        "status": "affected",
        "version": "0.9.3.5",
        "versionType": "custom"
      },
      {
        "lessThan": "1.1.0~beta1ubuntu0.16.04.7",
        "status": "affected",
        "version": "1.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "1.6.5ubuntu0.1",
        "status": "affected",
        "version": "1.6.5",
        "versionType": "custom"
      },
      {
        "lessThan": "1.9.0ubuntu1.2",
        "status": "affected",
        "version": "1.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "1.9.5",
        "status": "affected",
        "version": "1.9.5",
        "versionType": "custom"
      }
    ]
  }
]