4.7
Moyenne
CVE-2019-15796 Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py…
Description
Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Python-apt 1.9 | premières → < 1.9.5 | 1.9.0ubuntu1.2 |
| Python-apt 1.6 | premières → < 1.6.5ubuntu0.1 | 1.6.5ubuntu0.1 |
| Python-apt 1.1 | 1.1.0 → dernières | Pas de correctif indiqué |
| Python-apt 0.9 | premières → < 0.9.3.5ubuntu3+esm2 | 0.9.3.5ubuntu3+esm2 |
| Python-apt 0.8 | premières → < 0.8.3ubuntu7.5 | 0.8.3ubuntu7.5 |
Autres CVE de Python-apt
Les 4 CVE de Python-apt →
CVE-2025-6966
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to…
6.9
Moyenne
CVE-2020-27351
Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc,…
2.0
Faible
CVE-2019-15795
python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of…
4.7
Moyenne