CVE-2020-16122

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

CVSS v3 8.2 HIGH
CVSS v2.0 2.1 LOW

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098	Issue Tracking Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::

History

21 Nov 2024, 05:06

Type	Values Removed	Values Added
CVSS	v2 : ~~2.1~~ v3 : ~~7.8~~	v2 : 2.1 v3 : 8.2
References	~~() https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098 - Issue Tracking, Third Party Advisory~~	() https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098 - Issue Tracking, Third Party Advisory

Information

Published : 2020-11-07 04:15

Updated : 2024-11-21 05:06

NVD link : CVE-2020-16122

Mitre link : CVE-2020-16122

CVE.ORG link : CVE-2020-16122

JSON object : View

Products Affected

canonical

ubuntu_linux

packagekit_project

packagekit

CWE

CWE-269

Improper Privilege Management

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2020-16122", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-11-07T04:15:12.130", "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."}, {"lang": "es", "value": "El backend apt de PackageKit trat\u00f3 err\u00f3neamente a todas las debs locales como confiables. El modelo de seguridad de apt se basa en la confianza del repositorio y no en el contenido de archivos individuales. En sitios con reglas PolicyKit configuradas, esto puede permitir a los usuarios instalar paquetes maliciosos"}], "lastModified": "2024-11-21T05:06:48.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "936ABEE2-1ADB-44EB-AF92-818E0CE9B893"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}