Skip to content
OpenAdvisories
Low · 2.0 CVE-2020-27351 EUVD-2020-19863GHSA-mfw3-hgv3-pg44

Various memory and file descriptor leaks in apt-python

Published Dec 10, 2020 · Updated Sep 16, 2024 · Assigned by canonical

Vendor: Canonical Product: Python-apt Package: python-apt Package: python-apt Ecosystem: Debian Ecosystem: Ubuntu

Description

Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1;

Affected products

VendorProductAffectedFixed
Canonical python-apt 1.1.0~beta1 – < 1.1.0~beta1ubuntu0.16.04.10, 1.6.5ubuntu0 – < 1.6.5ubuntu0.4, 2.0.0ubuntu0 – < 2.0.0ubuntu0.20.04.2, 2.1.3ubuntu1 – < 2.1.3ubuntu1.1 1.1.0~beta1ubuntu0.16.04.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-apt 2.1.7 —
Debian 13 python-apt 2.1.7 —
Debian 12 python-apt 2.1.7 —
Debian 10 python-apt 1.8.4.2 DSA-4809-1
Debian 9 python-apt 1.4.2 DLA-2488-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS python-apt 2.0.0ubuntu0.20.04.2 USN-4668-1
Ubuntu 18.04 LTS python-apt 1.6.5ubuntu0.4 USN-4668-1
Ubuntu 16.04 LTS python-apt 1.1.0~beta1ubuntu0.16.04.10 USN-4668-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS python-apt 0.9.3.5ubuntu3+esm4 USN-4668-4

Advisories 4

References