CVE-2019-15796 python-apt downloads from untrusted sources
The python-apt library fails to verify repository signatures, allowing attackers to install malicious packages from unsigned sources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-15796?
CVE-2019-15796 is a medium-severity vulnerability in Canonical Python-apt, published on 26 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Which versions are affected by CVE-2019-15796?
10 open source packages ship an affected version, including python-apt. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
python-apt PyPI | All versions | 0.8.3ubuntu7.5 |
python-apt PyPI | All versions | 0.8.3ubuntu7.5 |
python-apt PyPI | From 0.9.0 | 0.9.3.5ubuntu3 |
python-apt PyPI | From 0.9.0 | 0.9.3.5ubuntu3 |
python-apt PyPI | From 1.2.0 | 1.6.5ubuntu0.1 |
python-apt PyPI | From 1.2.0 | 1.6.5ubuntu0.1 |
4 more packages
python-apt PyPI | From 1.7.0 | 1.9.0ubuntu1.2 |
python-apt PyPI | From 1.7.0 | 1.9.0ubuntu1.2 |
python-apt PyPI | From 1.9.1 | 1.9.5 |
python-apt PyPI | From 1.9.1 | 1.9.5 |
Products include Debian Python-Apt, Ubuntu Python-Apt.
How do I fix CVE-2019-15796?
Upgrade python-apt to a fixed version for your release line: 0.8.3ubuntu7.5, 0.9.3.5ubuntu3, 1.6.5ubuntu0.1 or 1.9.0ubuntu1.2.
Is CVE-2019-15796 being exploited?
There is no known exploitation of CVE-2019-15796 in the wild and no public exploit code.
Other vulnerabilities in Canonical Python-apt
Sources
Also known as DEBIAN-CVE-2019-15796, GHSA-pj65-3pf6-c5q4, UBUNTU-CVE-2019-15796.