Alerts This Week
Warning Icon 1 409
Alerts This Week
Warning Icon 1 409

Debian 8: DLA-2074-1 Critical: python-apt Package Integrity Risks

debian lts
Calendar Grey January 23, 2020
Dist Debian Esm H88
Numerous vulnerabilities have been identified in python-apt, necessitating updates for Debian 8 to safeguard package fidelity from potential risks.
Several issues have been found in python-apt, a python interface to libapt-pkg
Topics%20covered

Topics Covered

security advisory debian package update python-apt install issue

Summary

It was discovered that python-apt would still use MD5 hashes to validate
certain downloaded packages. If a remote attacker were able to perform a
man-in-the-middle attack, this flaw could potentially be used to install
altered packages.

CVE-2019-15796

It was discovered that python-apt could install packages from untrusted
repositories, contrary to expectations.

For Debian 8 "Jessie", these problems have been fixed in version
0.9.3.13.

We recommend that you upgrade your python-apt packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: python-apt
Version: 0.9.3.13
CVE ID: CVE-2019-15795 CVE-2019-15796
Debian Bug: 944696

Topics%20covered

Topics Covered

security advisory debian package update python-apt install issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here