CVE-2019-15795: python-apt Flawed Package Integrity Check
Summary
CVE-2019-15795: python-apt Flawed Package Integrity Check. Affects python-apt across 5 version ranges.
< 0.8.3ubuntu7.5
>= 0.9.0, < 0.9.3.5ubuntu3
>= 1.0.0, < 1.1.0
>= 1.2.0, < 1.6.5ubuntu0.1
>= 1.7.0, < 1.9.0ubuntu1.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- python-apt · Debian:11
The same CVE-2019-15795 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-apt is a Python library that provides an interface to the Advanced Package Tool (APT) package management system. It allows users to interact with APT to perform operations such as installing, upgrading, and removing packages on Debian-based systems. The library is widely used in various Python applications and scripts that require package management capabilities. However, versions 1.9.0ubuntu1 and earlier of python-apt suffer from a flawed package integrity check.
Vulnerability Detail
The vulnerability in python-apt arises from the lack of proper verification of downloaded package files. In the affected versions, the library only checks the MD5 sums of downloaded files in certain functions. This flaw opens up the possibility of a man-in-the-middle attack, where an attacker can intercept the package download process and replace the legitimate package with a malicious one. If successful, the attacker could potentially install altered packages on the target system, leading to various security risks and compromise of the system's integrity. The vulnerability has been assigned a CVSS score of 4.7.
How To Fix
Latest published version: 0.7.8 as of 22 Oct 2026
pip install --upgrade "python-apt==0.7.8"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.8.3ubuntu7.50.8.3ubuntu7.5pip install --upgrade "python-apt==0.8.3ubuntu7.5" -
>= 0.9.0, < 0.9.3.5ubuntu30.9.3.5ubuntu3pip install --upgrade "python-apt==0.9.3.5ubuntu3" -
>= 1.0.0, < 1.1.01.1.0pip install --upgrade "python-apt==1.1.0" -
>= 1.2.0, < 1.6.5ubuntu0.11.6.5ubuntu0.1pip install --upgrade "python-apt==1.6.5ubuntu0.1" -
>= 1.7.0, < 1.9.0ubuntu1.21.9.0ubuntu1.2pip install --upgrade "python-apt==1.9.0ubuntu1.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they download packages from trusted sources and verify the integrity of downloaded files using alternative methods, such as cryptographic checksums.
Conclusion
The python-apt library versions 1.9.0ubuntu1 and earlier suffer from a flawed package integrity check vulnerability. This can be exploited by a man-in-the-middle attacker to install altered packages on the target system. To mitigate the risk, users should update python-apt to one of the patched versions mentioned. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-apt →
FAQ
python-apt is a Python library that provides an interface to the Advanced Package Tool (APT) package management system on Debian-based systems.
The vulnerability allows a man-in-the-middle attack, potentially leading to the installation of altered packages and compromising the integrity of the system.
To fix the vulnerability, update python-apt to one of the patched versions: 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, or 0.8.3ubuntu7.5.
While there are no specific workarounds mentioned, users can mitigate the risk by downloading packages from trusted sources and verifying file integrity using cryptographic checksums.
The vulnerability has been assigned a CVSS score of 4.7.
Related vulnerabilities
Recent vulnerabilities recorded for python-apt.
