UbuntuUSN-4247-1python-apt vulnerabilities
2.6 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
4.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
32.5%
Releases
- Ubuntu 19.10
- Ubuntu 19.04
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
Packages
- python-apt - Python interface to libapt-pkg
Details
It was discovered that python-apt would still use MD5 hashes to validate
certain downloaded packages. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to install
altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted
repositories, contrary to expectations. (CVE-2019-15796)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 19.10 | noarch | python-apt | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python-apt-common | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python-apt-dbg | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python-apt-dev | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python-apt-doc | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python3-apt | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.10 | noarch | python3-apt-dbg | < 1.9.0ubuntu1.2 | UNKNOWN |
| Ubuntu | 19.04 | noarch | python-apt | < 1.8.5~ubuntu0.2 | UNKNOWN |
| Ubuntu | 19.04 | noarch | python-apt-common | < 1.8.5~ubuntu0.2 | UNKNOWN |
| Ubuntu | 19.04 | noarch | python-apt-dbg | < 1.8.5~ubuntu0.2 | UNKNOWN |
Related
2.6 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
4.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
32.5%