Critical Vulnerability in python-apt: Man-in-the-Middle Attack Risk
Summary
UBUNTU-CVE-2019-15795: python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. Affects python-apt versions < 0.9.3.5ubuntu3+esm2. Fixed in 0.9.3.5ubuntu3+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-apt is a Python interface to the Advanced Package Tool (APT) used in Debian-based systems, including Ubuntu. It allows users to manage packages, including installation, removal, and updates. The package is crucial for system maintenance and software management, making its security paramount. This vulnerability exposes users to potential man-in-the-middle attacks, compromising the integrity of package installations.
Vulnerability Detail
The vulnerability arises from python-apt's reliance on MD5 checksums for verifying the integrity of downloaded files in the Version.fetch_binary() and Version.fetch_source() methods of apt/package.py. This flaw, present in versions 1.9.0ubuntu1 and earlier, allows an attacker to intercept and alter packages during download, leading to the installation of compromised software. The vulnerability has been assigned a CVSS score of 4.7, indicating a medium severity risk.
How To Fix
Minimum fixed version
0.9.3.5ubuntu3+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-aptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using python-apt for critical package management tasks until the package is updated. Additionally, consider using alternative package management tools that implement stronger integrity checks.
Conclusion
The python-apt vulnerability poses a significant risk to users by allowing potential man-in-the-middle attacks. It is crucial to update to the latest patched versions to ensure the integrity of package management. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for python-apt →
FAQ
The vulnerability allows attackers to perform man-in-the-middle attacks, potentially leading to the installation of altered or malicious packages.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Versions 1.9.0ubuntu1 and earlier are affected. Users should upgrade to the patched versions to mitigate the risk.
While updating is the best solution, you can temporarily avoid using python-apt for critical tasks until the update is applied.
Detailed information can be found in the Ubuntu Security Notices and the CVE database, specifically for CVE-2019-15795.
Related vulnerabilities
Recent vulnerabilities recorded for python-apt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
