{"id":"CVE-2019-15796","aliases":["DEBIAN-CVE-2019-15796","DLA-2074-1","DSA-4609-1","EUVD-2022-4782","GHSA-pj65-3pf6-c5q4","UBUNTU-CVE-2019-15796","USN-4247-1","USN-4247-3"],"status":"published","title":"python-apt downloads from untrusted sources","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00509,"percentile":0.43725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-347"],"published":"2020-01-20T00:00:00Z","modified":"2026-09-21T07:02:13Z","fixes":[{"ecosystem":"PyPI","package":"python-apt","fixed_in":["0.8.3ubuntu7.5","0.9.3.5ubuntu3","1.6.5ubuntu0.1","1.9.0ubuntu1.2","1.9.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-apt","fixed_in":["1.8.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-apt","fixed_in":["1.8.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-apt","fixed_in":["1.8.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-apt","fixed_in":["0.9.3.5ubuntu3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-apt","fixed_in":["1.1.0~beta1ubuntu0.16.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-apt","fixed_in":["1.6.5ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.3ubuntu7.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.9.3.5ubuntu3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.6.5ubuntu0.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.9.0ubuntu1.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.1"},{"fixed":"1.9.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3.13"}]}],"versions":["0.9.3.11","0.9.3.12"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"versions":["1.4.0~beta3"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4.1"}]}],"versions":["1.8.4"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.3ubuntu7.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.9.3.5ubuntu3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.6.5ubuntu0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.9.0ubuntu1.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.1"},{"fixed":"1.9.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3.5ubuntu3+esm2"}]}],"versions":["0.8.9.1ubuntu1","0.9.0","0.9.1","0.9.1ubuntu1","0.9.3.2","0.9.3.2ubuntu2","0.9.3.3","0.9.3.3ubuntu1","0.9.3.4","0.9.3.4build1","0.9.3.5","0.9.3.5ubuntu1","0.9.3.5ubuntu2","0.9.3.5ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0~beta1ubuntu0.16.04.7"}]}],"versions":["1.0.1build1","1.0.1ubuntu2","1.1.0~beta1","1.1.0~beta1build1","1.1.0~beta1ubuntu0.16.04.1","1.1.0~beta1ubuntu0.16.04.2","1.1.0~beta1ubuntu0.16.04.4","1.1.0~beta1ubuntu0.16.04.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5ubuntu0.1"}]}],"versions":["1.4.0~beta3build2","1.4.0~beta3ubuntu1","1.6.0~rc2ubuntu1","1.6.0~rc2ubuntu2","1.6.0","1.6.1","1.6.2","1.6.3","1.6.3ubuntu1","1.6.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0~beta1ubuntu0.16.04.7"}]}],"versions":["1.0.1build1","1.0.1ubuntu2","1.1.0~beta1","1.1.0~beta1build1","1.1.0~beta1ubuntu0.16.04.1","1.1.0~beta1ubuntu0.16.04.2","1.1.0~beta1ubuntu0.16.04.4","1.1.0~beta1ubuntu0.16.04.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5ubuntu0.1"}]}],"versions":["1.4.0~beta3build2","1.4.0~beta3ubuntu1","1.6.0~rc2ubuntu1","1.6.0~rc2ubuntu2","1.6.0","1.6.1","1.6.2","1.6.3","1.6.3ubuntu1","1.6.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3.5ubuntu3+esm2"}]}],"versions":["0.8.9.1ubuntu1","0.9.0","0.9.1","0.9.1ubuntu1","0.9.3.2","0.9.3.2ubuntu2","0.9.3.3","0.9.3.3ubuntu1","0.9.3.4","0.9.3.4build1","0.9.3.5","0.9.3.5ubuntu1","0.9.3.5ubuntu2","0.9.3.5ubuntu3"],"bundled":2}],"products":[{"vendor":"canonical","product":"python-apt"},{"vendor":"debian","product":"python-apt"},{"vendor":"ubuntu","product":"python-apt"}],"references":[{"url":"https://usn.ubuntu.com/4247-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4247-3/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15796","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pj65-3pf6-c5q4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15796","tags":["advisory"]},{"url":"https://github.com/excid3/python-apt","tags":["package"]},{"url":"https://usn.ubuntu.com/4247-1","tags":["web"]},{"url":"https://usn.ubuntu.com/4247-3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-15796","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4247-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4247-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15795","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-15796","title":"python-apt downloads from untrusted sources","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-03-26T13:00:21.745Z","modified":"2024-09-16T22:14:45.095Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2022-4782","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-03-26T13:00:21Z","modified":"2024-09-16T22:14:45Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:04.822795Z"}],"ghsa":[{"id":"GHSA-pj65-3pf6-c5q4","title":"python-apt Does Not Check Hash Signature","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2022-05-24T17:12:47Z","modified":"2023-09-26T21:25:12Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2019-15796","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-03-26T13:15:12.843Z","modified":"2026-06-17T02:21:05.653Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-287","CWE-347"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-15796","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-03-26T13:15:12.843Z","modified":"2026-03-14T00:45:05.575607Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-15796","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-03-26T13:15:12.843Z","modified":"2026-09-21T07:02:13.525163244Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-pj65-3pf6-c5q4","title":"python-apt Does Not Check Hash Signature","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2022-05-24T17:12:47Z","modified":"2023-11-08T04:01:15.371344Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"UBUNTU-CVE-2019-15796","description":"Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.","status":"published","published":"2020-01-20T00:00:00Z","modified":"2026-04-22T12:12:26.092037Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2074-1","title":"python-apt - security update","status":"published","published":"2020-01-23T00:00:00Z","modified":"2026-03-09T01:20:56.568965Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4609-1","title":"python-apt - security update","status":"published","published":"2020-01-23T00:00:00Z","modified":"2026-03-09T02:09:46.899368Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4247-1","title":"python-apt vulnerabilities","description":"It was discovered that python-apt would still use MD5 hashes to validate\ncertain downloaded packages. If a remote attacker were able to perform a\nmachine-in-the-middle attack, this flaw could potentially be used to install\naltered packages. (CVE-2019-15795)\n\nIt was discovered that python-apt could install packages from untrusted\nrepositories, contrary to expectations. (CVE-2019-15796)\n","status":"published","published":"2020-01-22T18:15:12Z","modified":"2026-04-22T10:02:43.749488Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4247-3","title":"python-apt vulnerabilities","description":"USN-4247-1 fixed several vulnerabilities in python-apt. This update\nprovides the corresponding updates for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that python-apt would still use MD5 hashes to validate\n certain downloaded packages. If a remote attacker were able to perform a\n machine-in-the-middle attack, this flaw could potentially be used to install\n altered packages. (CVE-2019-15795)\n\n It was discovered that python-apt could install packages from untrusted\n repositories, contrary to expectations. (CVE-2019-15796)\n","status":"published","published":"2020-01-23T15:11:16Z","modified":"2026-04-22T10:02:06.295748Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}