CVE-2019-15795
python-apt uses MD5 for validation
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
python-apt uses MD5 for validation
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
CVE-2019-15795- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
EUVDEUVD-2022-5210
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
EUVD-2022-5210- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp8m-h266-53jh
python-apt Flawed Package Integrity Check
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
GHSA-rp8m-h266-53jh- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
NVD
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
CVE-2019-15795- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSV
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
CVE-2019-15795- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15795
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
DEBIAN-CVE-2019-15795- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-rp8m-h266-53jh
python-apt Flawed Package Integrity Check
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
GHSA-rp8m-h266-53jh- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15795
python-apt only checks the MD5 sums of downloaded files in Version.fetch_binary() and Version.fetch_source() of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
- Record
UBUNTU-CVE-2019-15795- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-4247-1 No score
python-apt vulnerabilities
It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted repositories, contrary to expectations. (CVE-2019-15796)
- Record
USN-4247-1- Updated
- 2026-11-02
OSVUSN-4247-3 No score
python-apt vulnerabilities
USN-4247-1 fixed several vulnerabilities in python-apt. This update provides the corresponding updates for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted repositories, contrary to expectations. (CVE-2019-15796)
- Record
USN-4247-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-aptPyPI |
before 0.8.3ubuntu7.5 | 0.8.3ubuntu7.5 |
python-aptPyPI |
0.9.0 up to 0.9.3.5ubuntu3 | 0.9.3.5ubuntu3 |
python-aptPyPI |
1.0.0 up to 1.1.0 | 1.1.0 |
python-aptPyPI |
1.2.0 up to 1.6.5ubuntu0.1 | 1.6.5ubuntu0.1 |
python-aptPyPI |
1.7.0 up to 1.9.0ubuntu1.2 | 1.9.0ubuntu1.2 |
python-aptDebian:12 |
before 1.8.5 | 1.8.5 |
python-aptDebian:13 |
before 1.8.5 | 1.8.5 |
python-aptDebian:14 |
before 1.8.5 | 1.8.5 |
python-aptDebian:8 From an advisory covering 2 CVEs |
before 0.9.3.13, plus listed versions 0.9.3.110.9.3.12 |
0.9.3.13 |
python-aptDebian:9 From an advisory covering 2 CVEs |
before 1.4.1, plus listed versions 1.4.0~beta3 |
1.4.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-aptDebian:10 From an advisory covering 2 CVEs |
before 1.8.4.1, plus listed versions 1.8.4 |
1.8.4.1 |
python-aptUbuntu:Pro:14.04:LTS |
before 0.9.3.5ubuntu3+esm2, plus listed versions 0.8.9.1ubuntu10.9.00.9.10.9.1ubuntu10.9.3.2 Show 9 moreShow less0.9.3.2ubuntu20.9.3.30.9.3.3ubuntu10.9.3.40.9.3.4build10.9.3.50.9.3.5ubuntu10.9.3.5ubuntu20.9.3.5ubuntu3 |
0.9.3.5ubuntu3+esm2 |
python-aptUbuntu:16.04:LTS |
before 1.1.0~beta1ubuntu0.16.04.7, plus listed versions 1.0.1build11.0.1ubuntu21.1.0~beta11.1.0~beta1build11.1.0~beta1ubuntu0.16.04.11.1.0~beta1ubuntu0.16.04.21.1.0~beta1ubuntu0.16.04.41.1.0~beta1ubuntu0.16.04.5 |
1.1.0~beta1ubuntu0.16.04.7 |
python-aptUbuntu:18.04:LTS |
before 1.6.5ubuntu0.1, plus listed versions 1.4.0~beta3build21.4.0~beta3ubuntu11.6.0~rc2ubuntu11.6.0~rc2ubuntu21.6.0 Show 5 moreShow less1.6.11.6.21.6.31.6.3ubuntu11.6.4 |
1.6.5ubuntu0.1 |
python-aptUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 1.1.0~beta1ubuntu0.16.04.7, plus listed versions 1.0.1build11.0.1ubuntu21.1.0~beta11.1.0~beta1build11.1.0~beta1ubuntu0.16.04.11.1.0~beta1ubuntu0.16.04.21.1.0~beta1ubuntu0.16.04.41.1.0~beta1ubuntu0.16.04.5 |
1.1.0~beta1ubuntu0.16.04.7 |
python-aptUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1.6.5ubuntu0.1, plus listed versions 1.4.0~beta3build21.4.0~beta3ubuntu11.6.0~rc2ubuntu11.6.0~rc2ubuntu21.6.0 Show 5 moreShow less1.6.11.6.21.6.31.6.3ubuntu11.6.4 |
1.6.5ubuntu0.1 |
python-aptUbuntu:Pro:14.04:LTS From an advisory covering 2 CVEs |
before 0.9.3.5ubuntu3+esm2, plus listed versions 0.8.9.1ubuntu10.9.00.9.10.9.1ubuntu10.9.3.2 Show 9 moreShow less0.9.3.2ubuntu20.9.3.30.9.3.3ubuntu10.9.3.40.9.3.4build10.9.3.50.9.3.5ubuntu10.9.3.5ubuntu20.9.3.5ubuntu3 |
0.9.3.5ubuntu3+esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15795 is a medium vulnerability (CVSS 4.7) in Canonical Python-apt, published January 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in python-apt 0.8.3ubuntu7.5.