USN-4247-2
python-apt regression
USN-4247-1 fixed vulnerabilities in python-apt. The updated packages caused a regression when attempting to upgrade to a new Ubuntu release. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted repositories, contrary to expectations. (CVE-2019-15796)
What each source reports
OSV No score
python-apt regression
USN-4247-1 fixed vulnerabilities in python-apt. The updated packages caused a regression when attempting to upgrade to a new Ubuntu release. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795)
It was discovered that python-apt could install packages from untrusted repositories, contrary to expectations. (CVE-2019-15796)
- Record
USN-4247-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-aptUbuntu:16.04:LTS |
before 1.1.0~beta1ubuntu0.16.04.8, plus listed versions 1.0.1build11.0.1ubuntu21.1.0~beta11.1.0~beta1build11.1.0~beta1ubuntu0.16.04.1 Show 4 moreShow less1.1.0~beta1ubuntu0.16.04.21.1.0~beta1ubuntu0.16.04.41.1.0~beta1ubuntu0.16.04.51.1.0~beta1ubuntu0.16.04.7 |
1.1.0~beta1ubuntu0.16.04.8 |
python-aptUbuntu:18.04:LTS |
before 1.6.5ubuntu0.2, plus listed versions 1.4.0~beta3build21.4.0~beta3ubuntu11.6.0~rc2ubuntu11.6.0~rc2ubuntu21.6.0 Show 6 moreShow less1.6.11.6.21.6.31.6.3ubuntu11.6.41.6.5ubuntu0.1 |
1.6.5ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4247-2 is a vulnerability with no CVSS score yet in python-apt, published January 22, 2020. No source lists public exploit code. Fixed in python-apt 1.1.0~beta1ubuntu0.16.04.8.