Strix
26.1K

CVE-2019-15796

MEDIUMCVSS 4.7/10EPSS 0.50%

Last modified

CVE-2019-15796 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.. EPSS estimates a 0.50% chance of exploitation in the next 30 days.

Description

Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

Metrics

CVSS 3.1
4.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.50%

38.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
UbuntuPython-Apt0.8.0Ubuntu9
UbuntuPython-Apt0.8.1Ubuntu1
UbuntuPython-Apt0.8.3Ubuntu1
UbuntuPython-Apt0.8.9.1—
UbuntuPython-Apt0.9.0—
UbuntuPython-Apt0.9.1—
UbuntuPython-Apt0.9.3.1—
UbuntuPython-Apt0.9.3.2—
UbuntuPython-Apt0.9.3.3—
UbuntuPython-Apt0.9.3.4—
UbuntuPython-Apt0.9.3.5—
UbuntuPython-Apt1.0.1Build1
UbuntuPython-Apt1.1.0Beta1
DebianPython-Apt1.8.4—
UbuntuPython-Apt1.4.0—
UbuntuPython-Apt1.6.0—
UbuntuPython-Apt1.6.1—
UbuntuPython-Apt1.6.2—
UbuntuPython-Apt1.6.3—
UbuntuPython-Apt1.6.4—
UbuntuPython-Apt1.8.4—
UbuntuPython-Apt1.9.0Alpha0\~Ubuntu1
UbuntuPython-Apt1.7.0—
UbuntuPython-Apt1.8.0—
UbuntuPython-Apt1.8.1—
UbuntuPython-Apt1.8.2—
UbuntuPython-Apt1.8.3—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-15796?
Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
How severe is CVE-2019-15796?
CVE-2019-15796 has a CVSS score of 4.7/10 (MEDIUM severity). The EPSS model estimates a 0.50% probability of exploitation in the next 30 days.
How do I fix CVE-2019-15796?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-15796?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST