{"id":"CVE-2020-16122","aliases":["DEBIAN-CVE-2020-16122","DLA-2399-1","EUVD-2020-8088","GHSA-jfj4-x686-g8vv","UBUNTU-CVE-2020-16122","USN-4538-1"],"status":"published","title":"Packagekit's apt backend lets user install untrusted local packages","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00339,"percentile":0.27716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-345"],"published":"2020-06-13T01:14:00Z","modified":"2026-10-26T12:01:41Z","fixes":[{"ecosystem":"Debian:12","package":"packagekit","fixed_in":["1.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"packagekit","fixed_in":["1.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"packagekit","fixed_in":["1.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"packagekit","fixed_in":["0.8.17-4ubuntu6~gcc5.4ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"packagekit","fixed_in":["1.1.9-1ubuntu2.18.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"packagekit","fixed_in":["1.1.13-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-2+deb9u2"}]}],"versions":["1.1.5-2","1.1.5-2+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"}]}],"versions":["0.8.17-4ubuntu6~gcc5.3","0.8.17-4ubuntu6~gcc5.4ubuntu1","0.8.17-4ubuntu6~gcc5.4ubuntu1.1","0.8.17-4ubuntu6~gcc5.4ubuntu1.2","0.8.17-4ubuntu6~gcc5.4ubuntu1.3","0.8.17-4ubuntu6~gcc5.4ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu2.18.04.6"}]}],"versions":["1.1.7-1","1.1.9-1","1.1.9-1ubuntu1","1.1.9-1ubuntu2","1.1.9-1ubuntu2.18.04.1","1.1.9-1ubuntu2.18.04.3","1.1.9-1ubuntu2.18.04.4","1.1.9-1ubuntu2.18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13-2ubuntu1.1"}]}],"versions":["1.1.12-5ubuntu4","1.1.13-1","1.1.13-2","1.1.13-2build1","1.1.13-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"}]}],"versions":["0.8.17-4ubuntu6~gcc5.3","0.8.17-4ubuntu6~gcc5.4ubuntu1","0.8.17-4ubuntu6~gcc5.4ubuntu1.1","0.8.17-4ubuntu6~gcc5.4ubuntu1.2","0.8.17-4ubuntu6~gcc5.4ubuntu1.3","0.8.17-4ubuntu6~gcc5.4ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu2.18.04.6"}]}],"versions":["1.1.7-1","1.1.9-1","1.1.9-1ubuntu1","1.1.9-1ubuntu2","1.1.9-1ubuntu2.18.04.1","1.1.9-1ubuntu2.18.04.3","1.1.9-1ubuntu2.18.04.4","1.1.9-1ubuntu2.18.04.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13-2ubuntu1.1"}]}],"versions":["1.1.12-5ubuntu4","1.1.13-1","1.1.13-2","1.1.13-2build1","1.1.13-2ubuntu1"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"packagekit","product":"packagekit"},{"vendor":"packagekit_project","product":"packagekit"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16122"},{"url":"https://github.com/advisories/GHSA-jfj4-x686-g8vv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-16122","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-16122","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4538-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-16121","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-16122","title":"Packagekit's apt backend lets user install untrusted local packages","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-11-07T04:10:19.889Z","modified":"2024-09-16T16:13:16.633Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8088","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-11-07T04:10:19Z","modified":"2024-09-16T16:13:16Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:53.971387Z"}],"ghsa":[{"id":"GHSA-jfj4-x686-g8vv","title":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is...","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2022-05-24T17:33:24Z","modified":"2023-02-02T05:08:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:52:40.925332Z"}],"nvd":[{"id":"CVE-2020-16122","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-11-07T04:15:12.13Z","modified":"2026-06-17T02:57:44.837Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-269","CWE-345"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-16122","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-11-07T04:15:12.13Z","modified":"2026-03-14T07:36:19.219647Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-16122","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-11-07T04:15:12.13Z","modified":"2026-10-26T12:01:41.047503954Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-16122","description":"PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.","status":"published","published":"2020-06-13T01:14:00Z","modified":"2026-04-22T12:30:43.897785Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2399-1","title":"packagekit - security update","status":"published","published":"2020-10-07T00:00:00Z","modified":"2026-03-09T01:19:51.452592Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-4538-1","title":"packagekit vulnerabilities","description":"Vaisha Bernard discovered that PackageKit incorrectly handled certain\nmethods. A local attacker could use this issue to learn the MIME type of\nany file on the system. (CVE-2020-16121)\n\nSami Niemimäki discovered that PackageKit incorrectly handled local deb\npackages. A local user could possibly use this issue to install untrusted\npackages, contrary to expectations. (CVE-2020-16122)\n","status":"published","published":"2020-09-24T13:03:59Z","modified":"2026-04-22T10:08:16.993244Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}