Strix
26.1K

CVE-2019-15795

MEDIUMCVSS 4.7/10EPSS 0.44%

Last modified

CVE-2019-15795 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.

Description

python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Metrics

CVSS 3.1
4.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.44%

35.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
UbuntuPython-Apt0.8.0Ubuntu9
UbuntuPython-Apt0.8.1Ubuntu1
UbuntuPython-Apt0.8.3Ubuntu1
UbuntuPython-Apt0.8.9.1—
UbuntuPython-Apt0.9.0—
UbuntuPython-Apt0.9.1—
UbuntuPython-Apt0.9.3.1—
UbuntuPython-Apt0.9.3.2—
UbuntuPython-Apt0.9.3.3—
UbuntuPython-Apt0.9.3.4—
UbuntuPython-Apt0.9.3.5—
UbuntuPython-Apt1.0.1Build1
UbuntuPython-Apt1.1.0Beta1
DebianPython-Apt1.8.4—
UbuntuPython-Apt1.4.0—
UbuntuPython-Apt1.6.0—
UbuntuPython-Apt1.6.1—
UbuntuPython-Apt1.6.2—
UbuntuPython-Apt1.6.3—
UbuntuPython-Apt1.6.4—
UbuntuPython-Apt1.8.4—
UbuntuPython-Apt1.9.0Alpha0\~Ubuntu1
UbuntuPython-Apt1.7.0—
UbuntuPython-Apt1.8.0—
UbuntuPython-Apt1.8.1—
UbuntuPython-Apt1.8.2—
UbuntuPython-Apt1.8.3—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-15795?
python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
How severe is CVE-2019-15795?
CVE-2019-15795 has a CVSS score of 4.7/10 (MEDIUM severity). The EPSS model estimates a 0.44% probability of exploitation in the next 30 days.
How do I fix CVE-2019-15795?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-15795?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST