Search criteria
6 vulnerabilities found for packagekit by packagekit
CVE-2020-16121 (GCVE-0-2020-16121)
Vulnerability from cvelistv5 – Published: 2020-11-07 04:10 – Updated: 2024-09-17 04:04
VLAI?
Summary
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
Severity ?
CWE
- CWE-209 - Information Exposure Through an Error Message
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| PackageKit | PackageKit |
Affected:
1.1.13-2ubuntu , < 1.1.13-2ubuntu1.1
(custom)
Affected: 1.1.9-1ubuntu2 , < 1.1.9-1ubuntu2.18.04.6 (custom) Affected: 0.8.17-4ubuntu6 , < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 (custom) |
Credits
Vaisha Bernard
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PackageKit",
"vendor": "PackageKit",
"versions": [
{
"lessThan": "1.1.13-2ubuntu1.1",
"status": "affected",
"version": "1.1.13-2ubuntu",
"versionType": "custom"
},
{
"lessThan": "1.1.9-1ubuntu2.18.04.6",
"status": "affected",
"version": "1.1.9-1ubuntu2",
"versionType": "custom"
},
{
"lessThan": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5",
"status": "affected",
"version": "0.8.17-4ubuntu6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Vaisha Bernard"
}
],
"datePublic": "2020-09-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Information Exposure Through an Error Message",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-07T04:10:19",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
],
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
],
"discovery": "EXTERNAL"
},
"title": "PackageKit error messages leak presence and mimetype of files to unprivileged users",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-09-24T00:00:00.000Z",
"ID": "CVE-2020-16121",
"STATE": "PUBLIC",
"TITLE": "PackageKit error messages leak presence and mimetype of files to unprivileged users"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PackageKit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.1.13-2ubuntu",
"version_value": "1.1.13-2ubuntu1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.9-1ubuntu2",
"version_value": "1.1.9-1ubuntu2.18.04.6"
},
{
"version_affected": "\u003c",
"version_name": "0.8.17-4ubuntu6",
"version_value": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5"
}
]
}
}
]
},
"vendor_name": "PackageKit"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Vaisha Bernard"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-209 Information Exposure Through an Error Message"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html",
"refsource": "MISC",
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
]
},
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2020-16121",
"datePublished": "2020-11-07T04:10:19.447213Z",
"dateReserved": "2020-07-29T00:00:00",
"dateUpdated": "2024-09-17T04:04:03.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-16122 (GCVE-0-2020-16122)
Vulnerability from cvelistv5 – Published: 2020-11-07 04:10 – Updated: 2024-09-16 16:13
VLAI?
Summary
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Severity ?
8.2 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| PackageKit | packagekit |
Affected:
1.1.13-2ubuntu , < 1.1.13-2ubuntu1.1
(custom)
Affected: 1.1.9-1ubuntu , < 1.1.9-1ubuntu2.18.04.6 (custom) Affected: 0.8.17-4ubuntu , < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 (custom) |
Credits
Sami Niemimäki and Esko Järnfors
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "packagekit",
"vendor": "PackageKit",
"versions": [
{
"lessThan": "1.1.13-2ubuntu1.1",
"status": "affected",
"version": "1.1.13-2ubuntu",
"versionType": "custom"
},
{
"lessThan": "1.1.9-1ubuntu2.18.04.6",
"status": "affected",
"version": "1.1.9-1ubuntu",
"versionType": "custom"
},
{
"lessThan": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5",
"status": "affected",
"version": "0.8.17-4ubuntu",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"
}
],
"datePublic": "2020-06-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PackageKit\u0027s apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-07T04:10:19",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
],
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
],
"discovery": "EXTERNAL"
},
"title": "Packagekit\u0027s apt backend lets user install untrusted local packages",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-06-12T00:00:00.000Z",
"ID": "CVE-2020-16122",
"STATE": "PUBLIC",
"TITLE": "Packagekit\u0027s apt backend lets user install untrusted local packages"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "packagekit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.1.13-2ubuntu",
"version_value": "1.1.13-2ubuntu1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.9-1ubuntu",
"version_value": "1.1.9-1ubuntu2.18.04.6"
},
{
"version_affected": "\u003c",
"version_name": "0.8.17-4ubuntu",
"version_value": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5"
}
]
}
}
]
},
"vendor_name": "PackageKit"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PackageKit\u0027s apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-269 Improper Privilege Management"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
]
},
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2020-16122",
"datePublished": "2020-11-07T04:10:19.889638Z",
"dateReserved": "2020-07-29T00:00:00",
"dateUpdated": "2024-09-16T16:13:16.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-2515 (GCVE-0-2011-2515)
Vulnerability from cvelistv5 – Published: 2019-11-27 20:18 – Updated: 2024-08-06 23:00
VLAI?
Summary
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
Severity ?
No CVSS data available.
CWE
- installs unsigned RPM packages as though they were signed
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| packagekit | packagekit |
Affected:
0.6.15
Affected: 0.6.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.249Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/cve-2011-2515"
},
{
"name": "48557",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "https://www.securityfocus.com/bid/48557/info"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "packagekit",
"vendor": "packagekit",
"versions": [
{
"status": "affected",
"version": "0.6.15"
},
{
"status": "affected",
"version": "0.6.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "installs unsigned RPM packages as though they were signed",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-27T20:18:50",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/cve-2011-2515"
},
{
"name": "48557",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "https://www.securityfocus.com/bid/48557/info"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2515",
"datePublished": "2019-11-27T20:18:50",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-16121 (GCVE-0-2020-16121)
Vulnerability from nvd – Published: 2020-11-07 04:10 – Updated: 2024-09-17 04:04
VLAI?
Summary
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
Severity ?
CWE
- CWE-209 - Information Exposure Through an Error Message
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| PackageKit | PackageKit |
Affected:
1.1.13-2ubuntu , < 1.1.13-2ubuntu1.1
(custom)
Affected: 1.1.9-1ubuntu2 , < 1.1.9-1ubuntu2.18.04.6 (custom) Affected: 0.8.17-4ubuntu6 , < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 (custom) |
Credits
Vaisha Bernard
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PackageKit",
"vendor": "PackageKit",
"versions": [
{
"lessThan": "1.1.13-2ubuntu1.1",
"status": "affected",
"version": "1.1.13-2ubuntu",
"versionType": "custom"
},
{
"lessThan": "1.1.9-1ubuntu2.18.04.6",
"status": "affected",
"version": "1.1.9-1ubuntu2",
"versionType": "custom"
},
{
"lessThan": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5",
"status": "affected",
"version": "0.8.17-4ubuntu6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Vaisha Bernard"
}
],
"datePublic": "2020-09-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Information Exposure Through an Error Message",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-07T04:10:19",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
],
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
],
"discovery": "EXTERNAL"
},
"title": "PackageKit error messages leak presence and mimetype of files to unprivileged users",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-09-24T00:00:00.000Z",
"ID": "CVE-2020-16121",
"STATE": "PUBLIC",
"TITLE": "PackageKit error messages leak presence and mimetype of files to unprivileged users"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PackageKit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.1.13-2ubuntu",
"version_value": "1.1.13-2ubuntu1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.9-1ubuntu2",
"version_value": "1.1.9-1ubuntu2.18.04.6"
},
{
"version_affected": "\u003c",
"version_name": "0.8.17-4ubuntu6",
"version_value": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5"
}
]
}
}
]
},
"vendor_name": "PackageKit"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Vaisha Bernard"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-209 Information Exposure Through an Error Message"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html",
"refsource": "MISC",
"url": "https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
}
]
},
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2020-16121",
"datePublished": "2020-11-07T04:10:19.447213Z",
"dateReserved": "2020-07-29T00:00:00",
"dateUpdated": "2024-09-17T04:04:03.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-16122 (GCVE-0-2020-16122)
Vulnerability from nvd – Published: 2020-11-07 04:10 – Updated: 2024-09-16 16:13
VLAI?
Summary
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Severity ?
8.2 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| PackageKit | packagekit |
Affected:
1.1.13-2ubuntu , < 1.1.13-2ubuntu1.1
(custom)
Affected: 1.1.9-1ubuntu , < 1.1.9-1ubuntu2.18.04.6 (custom) Affected: 0.8.17-4ubuntu , < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 (custom) |
Credits
Sami Niemimäki and Esko Järnfors
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "packagekit",
"vendor": "PackageKit",
"versions": [
{
"lessThan": "1.1.13-2ubuntu1.1",
"status": "affected",
"version": "1.1.13-2ubuntu",
"versionType": "custom"
},
{
"lessThan": "1.1.9-1ubuntu2.18.04.6",
"status": "affected",
"version": "1.1.9-1ubuntu",
"versionType": "custom"
},
{
"lessThan": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5",
"status": "affected",
"version": "0.8.17-4ubuntu",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"
}
],
"datePublic": "2020-06-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PackageKit\u0027s apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-07T04:10:19",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
],
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
],
"discovery": "EXTERNAL"
},
"title": "Packagekit\u0027s apt backend lets user install untrusted local packages",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-06-12T00:00:00.000Z",
"ID": "CVE-2020-16122",
"STATE": "PUBLIC",
"TITLE": "Packagekit\u0027s apt backend lets user install untrusted local packages"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "packagekit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.1.13-2ubuntu",
"version_value": "1.1.13-2ubuntu1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.9-1ubuntu",
"version_value": "1.1.9-1ubuntu2.18.04.6"
},
{
"version_affected": "\u003c",
"version_name": "0.8.17-4ubuntu",
"version_value": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5"
}
]
}
}
]
},
"vendor_name": "PackageKit"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PackageKit\u0027s apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-269 Improper Privilege Management"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
}
]
},
"source": {
"advisory": "https://ubuntu.com/security/notices/USN-4538-1",
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2020-16122",
"datePublished": "2020-11-07T04:10:19.889638Z",
"dateReserved": "2020-07-29T00:00:00",
"dateUpdated": "2024-09-16T16:13:16.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-2515 (GCVE-0-2011-2515)
Vulnerability from nvd – Published: 2019-11-27 20:18 – Updated: 2024-08-06 23:00
VLAI?
Summary
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
Severity ?
No CVSS data available.
CWE
- installs unsigned RPM packages as though they were signed
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| packagekit | packagekit |
Affected:
0.6.15
Affected: 0.6.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.249Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/cve-2011-2515"
},
{
"name": "48557",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "https://www.securityfocus.com/bid/48557/info"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "packagekit",
"vendor": "packagekit",
"versions": [
{
"status": "affected",
"version": "0.6.15"
},
{
"status": "affected",
"version": "0.6.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "installs unsigned RPM packages as though they were signed",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-27T20:18:50",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2515"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/cve-2011-2515"
},
{
"name": "48557",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "https://www.securityfocus.com/bid/48557/info"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2515",
"datePublished": "2019-11-27T20:18:50",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}