CVE-2019-15796
Summary
| CVE | CVE-2019-15796 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-03-26 13:15:00 UTC |
| Updated | 2020-10-19 19:38:00 UTC |
| Description | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. |
Risk And Classification
Problem Types: CWE-347
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.10 | All | All | All |
| Application | Debian | Python-apt | 1.8.4 | All | All | All |
| Application | Debian | Python-apt | 1.8.4 | All | All | All |
| Application | Ubuntu | Python-apt | 0.8.0 | ubuntu9 | All | All |
| Application | Ubuntu | Python-apt | 0.8.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu3 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu4 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu5 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu6 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.2 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.3 | All | All |
| Application | Ubuntu | Python-apt | 0.8.9.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.8.9.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.0 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | build1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | build2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.3 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.4 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.4 | build1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu3 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | build1 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1build1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.2 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.3 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.4 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.5 | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | beta3build2 | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | beta3ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc2ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc2ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc3 | All | All |
| Application | Ubuntu | Python-apt | 1.6.1 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.2 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.3 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.4 | All | All | All |
| Application | Ubuntu | Python-apt | 1.7.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0\~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0\~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.8.1 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.2 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.3 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.4 | All | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0\~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0\~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.0 | ubuntu9 | All | All |
| Application | Ubuntu | Python-apt | 0.8.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu3 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu4 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu5 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu6 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.1 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.2 | All | All |
| Application | Ubuntu | Python-apt | 0.8.3 | ubuntu7.3 | All | All |
| Application | Ubuntu | Python-apt | 0.8.9.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.8.9.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.0 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | build1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | build2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.1 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.2 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.3 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.4 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.4 | build1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | All | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 0.9.3.5 | ubuntu3 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | build1 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.0.1 | ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1build1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.1 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.2 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.3 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.4 | All | All |
| Application | Ubuntu | Python-apt | 1.1.0 | beta1ubuntu0.16.04.5 | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | beta3build2 | All | All |
| Application | Ubuntu | Python-apt | 1.4.0 | beta3ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc2ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc2ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.6.0 | rc3 | All | All |
| Application | Ubuntu | Python-apt | 1.6.1 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.2 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.3 | All | All | All |
| Application | Ubuntu | Python-apt | 1.6.3 | ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.6.4 | All | All | All |
| Application | Ubuntu | Python-apt | 1.7.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0\~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.8.0 | alpha0\~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.8.1 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.2 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.3 | All | All | All |
| Application | Ubuntu | Python-apt | 1.8.4 | All | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0\~ubuntu1 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | alpha0\~ubuntu2 | All | All |
| Application | Ubuntu | Python-apt | 1.9.0 | ubuntu1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| USN-4247-1: python-apt vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | Patch, Third Party Advisory |
| USN-4247-3: python-apt vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Julian Andres Klode
There are currently no legacy QID mappings associated with this CVE.