CVE-2019-15795 python-apt uses MD5 for validation
Man-in-the-middle attackers can install altered packages by exploiting weak MD5 validation in python-apt, requiring users to upgrade the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-15795?
CVE-2019-15795 is a medium-severity vulnerability in Canonical Python-apt, published on 26 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Weakness: CWE-327
Which versions are affected by CVE-2019-15795?
10 open source packages ship an affected version, including python-apt. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
python-apt PyPI | All versions | 0.8.3ubuntu7.5 |
python-apt PyPI | All versions | 0.8.3ubuntu7.5 |
python-apt PyPI | From 0.9.0 | 0.9.3.5ubuntu3 |
python-apt PyPI | From 0.9.0 | 0.9.3.5ubuntu3 |
python-apt PyPI | From 1.0.0 | 1.1.0 |
python-apt PyPI | From 1.0.0 | 1.1.0 |
4 more packages
python-apt PyPI | From 1.2.0 | 1.6.5ubuntu0.1 |
python-apt PyPI | From 1.2.0 | 1.6.5ubuntu0.1 |
python-apt PyPI | From 1.7.0 | 1.9.0ubuntu1.2 |
python-apt PyPI | From 1.7.0 | 1.9.0ubuntu1.2 |
Products include Debian Python-Apt, Ubuntu Python-Apt.
How do I fix CVE-2019-15795?
Upgrade python-apt to a fixed version for your release line: 0.8.3ubuntu7.5, 0.9.3.5ubuntu3, 1.1.0 or 1.6.5ubuntu0.1.
Is CVE-2019-15795 being exploited?
There is no known exploitation of CVE-2019-15795 in the wild and no public exploit code.
Other vulnerabilities in Canonical Python-apt
Sources
Also known as DEBIAN-CVE-2019-15795, GHSA-rp8m-h266-53jh, UBUNTU-CVE-2019-15795.