UbuntuUSN-4247-3python-apt vulnerabilities
4.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
5 Medium
AI Score
Confidence
High
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
31.8%
Releases
- Ubuntu 14.04 ESM
- Ubuntu 12.04
Packages
- python-apt - Python interface to libapt-pkg
Details
USN-4247-1 fixed several vulnerabilities in python-apt. This update
provides the corresponding updates for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that python-apt would still use MD5 hashes to validate
certain downloaded packages. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to install
altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted
repositories, contrary to expectations. (CVE-2019-15796)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 14.04 | noarch | python-apt | < 0.9.3.5ubuntu3+esm2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | python-apt | < 0.9.3.5ubuntu3 | UNKNOWN |
| Ubuntu | 14.04 | noarch | python-apt-dbg | < 0.9.3.5ubuntu3 | UNKNOWN |
| Ubuntu | 14.04 | noarch | python3-apt | < 0.9.3.5ubuntu3 | UNKNOWN |
| Ubuntu | 14.04 | noarch | python3-apt-dbg | < 0.9.3.5ubuntu3 | UNKNOWN |
| Ubuntu | 14.04 | noarch | python3-apt | < 0.9.3.5ubuntu3+esm2 | UNKNOWN |
| Ubuntu | 12.04 | noarch | python-apt | < 0.8.3ubuntu7.5 | UNKNOWN |
| Ubuntu | 12.04 | noarch | python-apt-dbg | < 0.8.3ubuntu7.5 | UNKNOWN |
| Ubuntu | 12.04 | noarch | python3-apt | < 0.8.3ubuntu7.5 | UNKNOWN |
| Ubuntu | 12.04 | noarch | python3-apt-dbg | < 0.8.3ubuntu7.5 | UNKNOWN |
Related
4.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
5 Medium
AI Score
Confidence
High
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
31.8%