Integer Overflow and Underflow Vulnerability in APT Package
Summary
DEBIAN-CVE-2020-27350: APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. Affects apt versions < 2.1.13. Fixed in 2.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
APT (Advanced Package Tool) is a powerful package management system used in Debian and its derivatives for handling the installation and removal of software packages. It simplifies the process of managing software on Unix-like operating systems by automating the retrieval, configuration, and installation of software packages. The vulnerability in question affects multiple versions of the APT package across various Debian releases, making it crucial for users to be aware of its implications.
Vulnerability Detail
APT has several integer overflows and underflows while parsing .deb packages, which can lead to unexpected behavior or crashes. This vulnerability, identified as GHSL-2020-168 and GHSL-2020-169, arises from flaws in the code responsible for extracting and processing package files. If exploited, this could allow an attacker to manipulate package installations, potentially leading to system compromise or denial of service. The affected files include apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc.
How To Fix
Minimum fixed version
2.1.13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade aptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected versions of APT until they are updated. This may involve manually installing packages or using alternative package management tools that do not rely on APT.
Conclusion
The integer overflow and underflow vulnerability in the APT package poses significant risks to users of Debian and its derivatives. It is essential to update to the patched version to ensure system security. Utilizing tools like Vulert can help monitor and alert users about such vulnerabilities in real-time.
See every vulnerability recorded for apt →
FAQ
The vulnerability can lead to integer overflows and underflows, which may result in system crashes or unauthorized access to the system.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The affected versions include APT versions prior to 2.1.13 across various Debian releases.
While the best practice is to update to the patched version, users can temporarily avoid using the affected versions of APT.
Detailed information can be found in the Debian CVE database or on the Vulert website, which provides real-time monitoring for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for apt.
