Skip to content
OpenAdvisories
Unscored CVE-2020-27349 EUVD-2020-19861GHSA-qxjq-5hf8-7hff

aptdaemon performed policykit permissions checks too late

Published Dec 9, 2020 · Updated Sep 16, 2024 · Assigned by canonical

Description

Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu14.5.

Affected products

VendorProductAffectedFixed
Canonical aptdaemon 1.1.1+bzr982-0ubuntu14 – < 1.1.1+bzr982-0ubuntu14.5, 1.1.1+bzr982-0ubuntu19 – < 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu32 – < 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu34 – < 1.1.1+bzr982-0ubuntu34.1 1.1.1+bzr982-0ubuntu14.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS aptdaemon 1.1.1+bzr982-0ubuntu32.3 USN-4664-1
Ubuntu 18.04 LTS aptdaemon 1.1.1+bzr982-0ubuntu19.5 USN-4664-1
Ubuntu 16.04 LTS aptdaemon 1.1.1+bzr982-0ubuntu14.5 USN-4664-1

Advisories 1

References