8.2
High
CVE-2020-16122 PackageKit's apt backend mistakenly treated all local debs as trusted
Description
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| packagekit 1.1 | 1.1.9-1ubuntu → < 1.1.13-2ubuntu1.1 | 1.1.13-2ubuntu1.1 |
| packagekit 0.8 | 0.8.17-4ubuntu → latest | No fix stated |
References
- bugs.launchpad.net bugs.launchpad.net
Timeline
- Published
- Last modified
Other CVEs of packagekit
The 4 CVEs of packagekit →
CVE-2026-41651
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a…
8.8
High
CVE-2020-16121
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and…
3.3
Low
CVE-2011-2515
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation…
Not rated