CVE-2019-15795

MEDIUM EPSS 35.1%
Published Mar 26, 20206y ago · Modified Jun 17, 20262w ago
4.7 CVSS 3.1
Medium
Find Similar
Published Mar 26, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

CVSS Details

Base Score
4.7
Exploitability
1.6
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
35.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-327

Affected Products 74

VendorProductVersionRange
ubuntupython-apt0.8.0any
ubuntupython-apt0.8.1any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
ubuntupython-apt0.8.3any
canonicalubuntu_linux12.04any
ubuntupython-apt0.8.9.1any
ubuntupython-apt0.8.9.1any
ubuntupython-apt0.9.0any
ubuntupython-apt0.9.1any
ubuntupython-apt0.9.1any
ubuntupython-apt0.9.1any
ubuntupython-apt0.9.1any
ubuntupython-apt0.9.3.1any
ubuntupython-apt0.9.3.2any
ubuntupython-apt0.9.3.2any
ubuntupython-apt0.9.3.2any
ubuntupython-apt0.9.3.3any
ubuntupython-apt0.9.3.3any
ubuntupython-apt0.9.3.4any
ubuntupython-apt0.9.3.4any
ubuntupython-apt0.9.3.5any
ubuntupython-apt0.9.3.5any
ubuntupython-apt0.9.3.5any
ubuntupython-apt0.9.3.5any
canonicalubuntu_linux14.04any
ubuntupython-apt1.0.1any
ubuntupython-apt1.0.1any
ubuntupython-apt1.0.1any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
ubuntupython-apt1.1.0any
canonicalubuntu_linux16.04any
debianpython-apt1.8.4any
ubuntupython-apt1.4.0any
ubuntupython-apt1.4.0any
ubuntupython-apt1.4.0any
ubuntupython-apt1.6.0any
ubuntupython-apt1.6.0any
ubuntupython-apt1.6.0any
ubuntupython-apt1.6.0any
ubuntupython-apt1.6.0any
ubuntupython-apt1.6.1any
ubuntupython-apt1.6.2any
ubuntupython-apt1.6.3any
ubuntupython-apt1.6.3any
ubuntupython-apt1.6.4any
ubuntupython-apt1.8.4any
canonicalubuntu_linux18.04any
ubuntupython-apt1.8.4any
ubuntupython-apt1.9.0any
ubuntupython-apt1.9.0any
ubuntupython-apt1.9.0any
canonicalubuntu_linux19.10any
ubuntupython-apt1.7.0any
ubuntupython-apt1.8.0any
ubuntupython-apt1.8.0any
ubuntupython-apt1.8.0any
ubuntupython-apt1.8.1any
ubuntupython-apt1.8.2any
ubuntupython-apt1.8.3any
ubuntupython-apt1.8.4any
canonicalubuntu_linux19.04any

References 2

Remediation