CVE-2019-15796

Summary

Python-apt doesn't check if hashes are signed in Version.fetch_binary() and Version.fetch_source() of apt/package.py or in _fetch_archives() of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Affected Software

VendorProductVersion RangeStatus
CanonicalPython-apt0.8.3 < 0.8.3ubuntu7.5affected
CanonicalPython-apt0.9.3.5 < 0.9.3.5ubuntu3+esm2affected
CanonicalPython-apt1.1.0 < 1.1.0~beta1ubuntu0.16.04.7affected
CanonicalPython-apt1.6.5 < 1.6.5ubuntu0.1affected
CanonicalPython-apt1.9.0 < 1.9.0ubuntu1.2affected
CanonicalPython-apt1.9.5 < 1.9.5affected

Weaknesses

  • CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CVE Program Container

Additional References

References