CVE-2021-32556
apport get_modified_conffiles() function command injection
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
apport get_modified_conffiles() function command injection
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Record
CVE-2021-32556- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2021-19401
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Record
EUVD-2021-19401- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6hq6-w9x9-j77g No score
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py...
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Record
GHSA-6hq6-w9x9-j77g- Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Record
CVE-2021-32556- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32556
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Record
UBUNTU-CVE-2021-32556- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUSN-4965-1 No score
apport vulnerabilities
Maik Münch discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use these issues to read and write arbitrary files as an administrator, and possibly escalate privileges.
- Record
USN-4965-1- Updated
- 2026-11-02
OSVUSN-4965-2 No score
apport vulnerabilities
USN-4965-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details:
Maik Münch discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use these issues to read and write arbitrary files as an administrator, and possibly escalate privileges.
- Record
USN-4965-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apportUbuntu:Pro:14.04:LTS |
before 2.14.1-0ubuntu3.29+esm7, plus listed versions 2.12.5-0ubuntu22.12.6-0ubuntu12.12.7-0ubuntu12.12.7-0ubuntu22.12.7-0ubuntu3 Show 43 moreShow less2.12.7-0ubuntu62.13.1-0ubuntu12.13.1-0ubuntu22.13.2-0ubuntu22.13.2-0ubuntu32.13.2-0ubuntu42.13.2-0ubuntu52.13.3-0ubuntu12.14-0ubuntu12.14.1-0ubuntu12.14.1-0ubuntu22.14.1-0ubuntu32.14.1-0ubuntu3.12.14.1-0ubuntu3.22.14.1-0ubuntu3.32.14.1-0ubuntu3.42.14.1-0ubuntu3.52.14.1-0ubuntu3.62.14.1-0ubuntu3.72.14.1-0ubuntu3.82.14.1-0ubuntu3.92.14.1-0ubuntu3.102.14.1-0ubuntu3.112.14.1-0ubuntu3.122.14.1-0ubuntu3.132.14.1-0ubuntu3.152.14.1-0ubuntu3.162.14.1-0ubuntu3.182.14.1-0ubuntu3.192.14.1-0ubuntu3.202.14.1-0ubuntu3.212.14.1-0ubuntu3.232.14.1-0ubuntu3.242.14.1-0ubuntu3.252.14.1-0ubuntu3.272.14.1-0ubuntu3.282.14.1-0ubuntu3.292.14.1-0ubuntu3.29+esm12.14.1-0ubuntu3.29+esm22.14.1-0ubuntu3.29+esm32.14.1-0ubuntu3.29+esm42.14.1-0ubuntu3.29+esm52.14.1-0ubuntu3.29+esm6 |
2.14.1-0ubuntu3.29+esm7 |
apportUbuntu:Pro:16.04:LTS |
before 2.20.1-0ubuntu2.30+esm1, plus listed versions 2.19.1-0ubuntu32.19.2-0ubuntu12.19.2-0ubuntu22.19.2-0ubuntu32.19.2-0ubuntu4 Show 38 moreShow less2.19.2-0ubuntu52.19.2-0ubuntu62.19.2-0ubuntu82.19.2-0ubuntu92.19.3-0ubuntu12.19.3-0ubuntu22.19.3-0ubuntu32.19.4-0ubuntu12.19.4-0ubuntu22.20-0ubuntu22.20-0ubuntu32.20.1-0ubuntu12.20.1-0ubuntu22.20.1-0ubuntu2.12.20.1-0ubuntu2.22.20.1-0ubuntu2.42.20.1-0ubuntu2.52.20.1-0ubuntu2.62.20.1-0ubuntu2.92.20.1-0ubuntu2.102.20.1-0ubuntu2.122.20.1-0ubuntu2.132.20.1-0ubuntu2.142.20.1-0ubuntu2.152.20.1-0ubuntu2.162.20.1-0ubuntu2.172.20.1-0ubuntu2.182.20.1-0ubuntu2.192.20.1-0ubuntu2.202.20.1-0ubuntu2.212.20.1-0ubuntu2.222.20.1-0ubuntu2.232.20.1-0ubuntu2.242.20.1-0ubuntu2.252.20.1-0ubuntu2.262.20.1-0ubuntu2.272.20.1-0ubuntu2.282.20.1-0ubuntu2.30 |
2.20.1-0ubuntu2.30+esm1 |
apportUbuntu:18.04:LTS |
before 2.20.9-0ubuntu7.24, plus listed versions 2.20.7-0ubuntu32.20.7-0ubuntu3.12.20.7-0ubuntu42.20.8-0ubuntu12.20.8-0ubuntu2 Show 35 moreShow less2.20.8-0ubuntu32.20.8-0ubuntu42.20.8-0ubuntu52.20.8-0ubuntu62.20.8-0ubuntu72.20.8-0ubuntu82.20.8-0ubuntu92.20.8-0ubuntu102.20.9-0ubuntu12.20.9-0ubuntu22.20.9-0ubuntu42.20.9-0ubuntu52.20.9-0ubuntu62.20.9-0ubuntu72.20.9-0ubuntu7.12.20.9-0ubuntu7.22.20.9-0ubuntu7.32.20.9-0ubuntu7.42.20.9-0ubuntu7.52.20.9-0ubuntu7.62.20.9-0ubuntu7.72.20.9-0ubuntu7.82.20.9-0ubuntu7.92.20.9-0ubuntu7.112.20.9-0ubuntu7.122.20.9-0ubuntu7.132.20.9-0ubuntu7.142.20.9-0ubuntu7.152.20.9-0ubuntu7.162.20.9-0ubuntu7.172.20.9-0ubuntu7.182.20.9-0ubuntu7.192.20.9-0ubuntu7.202.20.9-0ubuntu7.212.20.9-0ubuntu7.23 |
2.20.9-0ubuntu7.24 |
apportUbuntu:20.04:LTS |
before 2.20.11-0ubuntu27.18, plus listed versions 2.20.11-0ubuntu82.20.11-0ubuntu92.20.11-0ubuntu132.20.11-0ubuntu142.20.11-0ubuntu15 Show 24 moreShow less2.20.11-0ubuntu162.20.11-0ubuntu172.20.11-0ubuntu182.20.11-0ubuntu192.20.11-0ubuntu202.20.11-0ubuntu212.20.11-0ubuntu222.20.11-0ubuntu242.20.11-0ubuntu252.20.11-0ubuntu262.20.11-0ubuntu272.20.11-0ubuntu27.22.20.11-0ubuntu27.32.20.11-0ubuntu27.42.20.11-0ubuntu27.62.20.11-0ubuntu27.82.20.11-0ubuntu27.92.20.11-0ubuntu27.102.20.11-0ubuntu27.112.20.11-0ubuntu27.122.20.11-0ubuntu27.132.20.11-0ubuntu27.142.20.11-0ubuntu27.162.20.11-0ubuntu27.17 |
2.20.11-0ubuntu27.18 |
apportUbuntu:18.04:LTS From an advisory covering 11 CVEs |
before 2.20.9-0ubuntu7.24, plus listed versions 2.20.7-0ubuntu32.20.7-0ubuntu3.12.20.7-0ubuntu42.20.8-0ubuntu12.20.8-0ubuntu2 Show 35 moreShow less2.20.8-0ubuntu32.20.8-0ubuntu42.20.8-0ubuntu52.20.8-0ubuntu62.20.8-0ubuntu72.20.8-0ubuntu82.20.8-0ubuntu92.20.8-0ubuntu102.20.9-0ubuntu12.20.9-0ubuntu22.20.9-0ubuntu42.20.9-0ubuntu52.20.9-0ubuntu62.20.9-0ubuntu72.20.9-0ubuntu7.12.20.9-0ubuntu7.22.20.9-0ubuntu7.32.20.9-0ubuntu7.42.20.9-0ubuntu7.52.20.9-0ubuntu7.62.20.9-0ubuntu7.72.20.9-0ubuntu7.82.20.9-0ubuntu7.92.20.9-0ubuntu7.112.20.9-0ubuntu7.122.20.9-0ubuntu7.132.20.9-0ubuntu7.142.20.9-0ubuntu7.152.20.9-0ubuntu7.162.20.9-0ubuntu7.172.20.9-0ubuntu7.182.20.9-0ubuntu7.192.20.9-0ubuntu7.202.20.9-0ubuntu7.212.20.9-0ubuntu7.23 |
2.20.9-0ubuntu7.24 |
apportUbuntu:20.04:LTS From an advisory covering 11 CVEs |
before 2.20.11-0ubuntu27.18, plus listed versions 2.20.11-0ubuntu82.20.11-0ubuntu92.20.11-0ubuntu132.20.11-0ubuntu142.20.11-0ubuntu15 Show 24 moreShow less2.20.11-0ubuntu162.20.11-0ubuntu172.20.11-0ubuntu182.20.11-0ubuntu192.20.11-0ubuntu202.20.11-0ubuntu212.20.11-0ubuntu222.20.11-0ubuntu242.20.11-0ubuntu252.20.11-0ubuntu262.20.11-0ubuntu272.20.11-0ubuntu27.22.20.11-0ubuntu27.32.20.11-0ubuntu27.42.20.11-0ubuntu27.62.20.11-0ubuntu27.82.20.11-0ubuntu27.92.20.11-0ubuntu27.102.20.11-0ubuntu27.112.20.11-0ubuntu27.122.20.11-0ubuntu27.132.20.11-0ubuntu27.142.20.11-0ubuntu27.162.20.11-0ubuntu27.17 |
2.20.11-0ubuntu27.18 |
apportUbuntu:Pro:14.04:LTS From an advisory covering 11 CVEs |
before 2.14.1-0ubuntu3.29+esm7, plus listed versions 2.12.5-0ubuntu22.12.6-0ubuntu12.12.7-0ubuntu12.12.7-0ubuntu22.12.7-0ubuntu3 Show 43 moreShow less2.12.7-0ubuntu62.13.1-0ubuntu12.13.1-0ubuntu22.13.2-0ubuntu22.13.2-0ubuntu32.13.2-0ubuntu42.13.2-0ubuntu52.13.3-0ubuntu12.14-0ubuntu12.14.1-0ubuntu12.14.1-0ubuntu22.14.1-0ubuntu32.14.1-0ubuntu3.12.14.1-0ubuntu3.22.14.1-0ubuntu3.32.14.1-0ubuntu3.42.14.1-0ubuntu3.52.14.1-0ubuntu3.62.14.1-0ubuntu3.72.14.1-0ubuntu3.82.14.1-0ubuntu3.92.14.1-0ubuntu3.102.14.1-0ubuntu3.112.14.1-0ubuntu3.122.14.1-0ubuntu3.132.14.1-0ubuntu3.152.14.1-0ubuntu3.162.14.1-0ubuntu3.182.14.1-0ubuntu3.192.14.1-0ubuntu3.202.14.1-0ubuntu3.212.14.1-0ubuntu3.232.14.1-0ubuntu3.242.14.1-0ubuntu3.252.14.1-0ubuntu3.272.14.1-0ubuntu3.282.14.1-0ubuntu3.292.14.1-0ubuntu3.29+esm12.14.1-0ubuntu3.29+esm22.14.1-0ubuntu3.29+esm32.14.1-0ubuntu3.29+esm42.14.1-0ubuntu3.29+esm52.14.1-0ubuntu3.29+esm6 |
2.14.1-0ubuntu3.29+esm7 |
apportUbuntu:Pro:16.04:LTS From an advisory covering 11 CVEs |
before 2.20.1-0ubuntu2.30+esm1, plus listed versions 2.19.1-0ubuntu32.19.2-0ubuntu12.19.2-0ubuntu22.19.2-0ubuntu32.19.2-0ubuntu4 Show 38 moreShow less2.19.2-0ubuntu52.19.2-0ubuntu62.19.2-0ubuntu82.19.2-0ubuntu92.19.3-0ubuntu12.19.3-0ubuntu22.19.3-0ubuntu32.19.4-0ubuntu12.19.4-0ubuntu22.20-0ubuntu22.20-0ubuntu32.20.1-0ubuntu12.20.1-0ubuntu22.20.1-0ubuntu2.12.20.1-0ubuntu2.22.20.1-0ubuntu2.42.20.1-0ubuntu2.52.20.1-0ubuntu2.62.20.1-0ubuntu2.92.20.1-0ubuntu2.102.20.1-0ubuntu2.122.20.1-0ubuntu2.132.20.1-0ubuntu2.142.20.1-0ubuntu2.152.20.1-0ubuntu2.162.20.1-0ubuntu2.172.20.1-0ubuntu2.182.20.1-0ubuntu2.192.20.1-0ubuntu2.202.20.1-0ubuntu2.212.20.1-0ubuntu2.222.20.1-0ubuntu2.232.20.1-0ubuntu2.242.20.1-0ubuntu2.252.20.1-0ubuntu2.262.20.1-0ubuntu2.272.20.1-0ubuntu2.282.20.1-0ubuntu2.30 |
2.20.1-0ubuntu2.30+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32556 is a low vulnerability (CVSS 3.8) in Canonical Apport, published May 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in apport 2.14.1-0ubuntu3.29+esm7.
References
bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
nvd.nist.gov/vuln/detail/CVE-2021-32556
github.com/advisories/GHSA-6hq6-w9x9-j77g
ubuntu.com/security/CVE-2021-32556
Show 11 moreShow less
cve.org/CVERecord?id=CVE-2021-32556