USN-4247-1: python-apt vulnerabilities
It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795) It was discovered that python-apt could install packages from untrusted repositories, contrary to expectations. (CVE-2019-15796)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-4247-1?
The severity of USN-4247-1 is considered important as it allows for potential remote package alteration.
How do I fix USN-4247-1?
To fix USN-4247-1, upgrade the python-apt or python3-apt package to the versions specified in the notice.
What versions of python-apt are affected by USN-4247-1?
USN-4247-1 affects python-apt versions prior to 1.9.0ubuntu1.2 on specific Ubuntu releases.
What is CVE-2019-15795 related to USN-4247-1?
CVE-2019-15795 is the identifier for the vulnerability that allows attackers to alter package installations.
What should I do if I'm unable to upgrade python-apt as per USN-4247-1?
If you cannot upgrade python-apt, consider implementing network measures to mitigate the risk of man-in-the-middle attacks.