CVE-2019-15796: Improper Verification of Cryptographic Signature

May 24, 2022 (updated July 18, 2023)

Python-apt does not check if hashes are signed in Version.fetch_binary() and Version.fetch_source() of apt/package.py or in _fetch_archives() of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn’t be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

References

github.com/advisories/GHSA-pj65-3pf6-c5q4
nvd.nist.gov/vuln/detail/CVE-2019-15796
usn.ubuntu.com/4247-1/
usn.ubuntu.com/4247-3/

Code Behaviors & Features

Detect and mitigate CVE-2019-15796 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →