{"id":"CVE-2020-15709","aliases":["DEBIAN-CVE-2020-15709","DLA-2339-1","EUVD-2020-7695","GHSA-9gjg-6646-fqxh","UBUNTU-CVE-2020-15709","USN-4457-1","USN-4457-2"],"status":"published","title":"add-apt-repository print ASNI terminal codes","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00325,"percentile":0.25786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-08-03T14:41:00Z","modified":"2026-10-26T12:02:27Z","fixes":[{"ecosystem":"Debian:9","package":"software-properties","fixed_in":["0.96.20.2-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"software-properties","fixed_in":["0.92.37.8ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"software-properties","fixed_in":["0.96.20.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"software-properties","fixed_in":["0.96.24.32.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"software-properties","fixed_in":["0.98.9.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.111-1","0.99.30-4","0.99.30-4.1","0.99.30-4.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:9","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96.20.2-1+deb9u1"}]}],"versions":["0.96.20.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92.37.8ubuntu0.1~esm1"}]}],"versions":["0.92.27","0.92.28","0.92.29","0.92.30","0.92.31","0.92.32","0.92.34","0.92.35","0.92.36","0.92.37","0.92.37.1","0.92.37.2","0.92.37.3","0.92.37.5","0.92.37.6","0.92.37.7","0.92.37.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96.20.10"}]}],"versions":["0.96.13","0.96.15","0.96.16","0.96.17","0.96.18","0.96.20","0.96.20.1","0.96.20.2","0.96.20.3","0.96.20.4","0.96.20.5","0.96.20.6","0.96.20.7","0.96.20.8","0.96.20.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96.24.32.14"}]}],"versions":["0.96.24.17","0.96.24.19","0.96.24.20","0.96.24.21","0.96.24.22","0.96.24.23","0.96.24.24","0.96.24.25","0.96.24.26","0.96.24.27","0.96.24.28","0.96.24.31","0.96.24.32.1","0.96.24.32.2","0.96.24.32.3","0.96.24.32.4","0.96.24.32.5","0.96.24.32.6","0.96.24.32.7","0.96.24.32.8","0.96.24.32.9","0.96.24.32.11","0.96.24.32.12","0.96.24.32.13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.9.2"}]}],"versions":["0.98.5","0.98.6","0.98.7","0.98.9","0.98.9.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96.20.10"}]}],"versions":["0.96.13","0.96.15","0.96.16","0.96.17","0.96.18","0.96.20","0.96.20.1","0.96.20.2","0.96.20.3","0.96.20.4","0.96.20.5","0.96.20.6","0.96.20.7","0.96.20.8","0.96.20.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96.24.32.14"}]}],"versions":["0.96.24.17","0.96.24.19","0.96.24.20","0.96.24.21","0.96.24.22","0.96.24.23","0.96.24.24","0.96.24.25","0.96.24.26","0.96.24.27","0.96.24.28","0.96.24.31","0.96.24.32.1","0.96.24.32.2","0.96.24.32.3","0.96.24.32.4","0.96.24.32.5","0.96.24.32.6","0.96.24.32.7","0.96.24.32.8","0.96.24.32.9","0.96.24.32.11","0.96.24.32.12","0.96.24.32.13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.9.2"}]}],"versions":["0.98.5","0.98.6","0.98.7","0.98.9","0.98.9.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"software-properties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92.37.8ubuntu0.1~esm1"}]}],"versions":["0.92.27","0.92.28","0.92.29","0.92.30","0.92.31","0.92.32","0.92.34","0.92.35","0.92.36","0.92.37","0.92.37.1","0.92.37.2","0.92.37.3","0.92.37.5","0.92.37.6","0.92.37.7","0.92.37.8"]}],"products":[{"vendor":"canonical","product":"add-apt-repository"}],"references":[{"url":"https://git.launchpad.net/software-properties/commit/add-apt-repository?id=97e2fe7d181e8711e0f5253d3b8db40426c17f1e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15709"},{"url":"https://github.com/advisories/GHSA-9gjg-6646-fqxh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15709","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15709","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/08/03/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4457-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4457-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15709","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15709","title":"add-apt-repository print ASNI terminal codes","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-09-05T03:30:18.015Z","modified":"2024-09-17T01:51:18.15Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7695","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-09-05T03:30:18Z","modified":"2024-09-17T01:51:18Z","updated_at":"2026-11-03T00:28:46.164413Z"}],"ghsa":[{"id":"GHSA-9gjg-6646-fqxh","title":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1...","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2022-05-24T17:27:28Z","modified":"2023-01-29T05:03:45Z","updated_at":"2026-11-02T14:45:23.726919Z"}],"nvd":[{"id":"CVE-2020-15709","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-09-05T04:15:13.743Z","modified":"2026-06-17T02:57:06.03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-15709","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-09-05T04:15:13.743Z","modified":"2026-03-14T10:18:29.260964Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15709","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-09-05T04:15:13.743Z","modified":"2026-10-26T12:02:27.562891338Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15709","description":"Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.","status":"published","published":"2020-08-03T14:41:00Z","modified":"2026-02-04T03:28:37.731812Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2339-1","title":"software-properties - security update","status":"published","published":"2020-08-22T00:00:00Z","modified":"2026-03-09T01:20:30.745717Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-4457-1","title":"software-properties vulnerability","description":"Jason A. Donenfeld discovered that Software Properties incorrectly filtered\ncertain escape sequences when displaying PPA descriptions. If a user were\ntricked into adding an arbitrary PPA, a remote attacker could possibly\nmanipulate the screen.\n","status":"published","published":"2020-08-12T13:56:37Z","modified":"2026-02-10T04:41:54Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4457-2","title":"software-properties vulnerability","description":"USN-4457-1 fixed a vulnerability in Software. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Jason A. Donenfeld discovered that Software Properties incorrectly filtered\n certain escape sequences when displaying PPA descriptions. If a user were\n tricked into adding an arbitrary PPA, a remote attacker could possibly\n manipulate the screen.\n","status":"published","published":"2020-08-17T14:30:26Z","modified":"2026-02-10T04:41:54Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}