Description
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | python-apt | 3.0 – < 3.0.0ubuntu1.1, 3.0 – < 3.0.0ubuntu0.25.04.1, 2.7 – < 2.7.7ubuntu5.1, 2.4 – < 2.4.0ubuntu4.1, 2.0 – < 2.0.1ubuntu0.20.04.1+esm1, 1.6 – < 1.6.6ubuntu0.1~esm1, 1.1 – < 1.1.0~beta1ubuntu0.16.04.12+esm1, < 0.9.3.5ubuntu3+esm5 | 3.0.0ubuntu1.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-apt | 3.1.0 | — |
| Debian 13 | python-apt | No fix yet | — |
| Debian 12 | python-apt | No fix yet | — |
| Debian 11 | python-apt | 2.2.1.1 | DLA-4408-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | python-apt | 3.0.0ubuntu1.1 | — |
| Ubuntu 24.04 LTS | python-apt | 2.7.7ubuntu5.1 | — |
| Ubuntu 22.04 LTS | python-apt | 2.4.0ubuntu4.1 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-apt | 2.0.1ubuntu0.20.04.1+esm1 | USN-7916-2 |
| Ubuntu Pro 18.04 LTS | python-apt | 1.6.6ubuntu0.1~esm1 | — |
| Ubuntu Pro 16.04 LTS | python-apt | 1.1.0~beta1ubuntu0.16.04.12+esm1 | — |
| Ubuntu Pro 14.04 LTS | python-apt | 0.9.3.5ubuntu3+esm5 | — |
Advisories 2
- USN-7916-2 python-apt regression Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-4408-1 python-apt - security update Debian Security (DSA / DLA) · Dec 16, 2025