Description
Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Canonical | Python-apt | affected |
|
Configuration 1 [-]
| AND |
|
Configuration 2 [-]
| AND |
|
Configuration 3 [-]
| AND |
|
Configuration 4 [-]
| AND |
|
Configuration 5 [-]
| AND |
|
Configuration 6 [-]
| AND |
|
No data.
No data available yet.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-2074-1 | python-apt security update |
 Debian DSA |
DSA-4609-1 | python-apt security update |
 EUVD |
EUVD-2022-4782 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. |
 Github GHSA |
GHSA-pj65-3pf6-c5q4 | python-apt Does Not Check Hash Signature |
 Ubuntu USN |
USN-4247-1 | python-apt vulnerabilities |
| Ubuntu USN |
USN-4247-3 | python-apt vulnerabilities |
References
| Link | Providers |
|---|---|
| https://usn.ubuntu.com/4247-1/ |
|
| https://usn.ubuntu.com/4247-3/ |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: canonical
Published:
Updated: 2024-09-16T22:14:45.095Z
Reserved: 2019-08-29T00:00:00.000Z
Link: CVE-2019-15796
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-03-26T13:15:12.843
Modified: 2024-11-21T04:29:29.153
Link: CVE-2019-15796
Redhat
No data.
OpenCVE Enrichment
No data.