CVE-2020-16122CWE-269

Packagekit's apt backend lets user install untrusted local packages

High · published November 7, 2020

CVSS v3.1
8.2
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2020-11-07T04:10Z
EPSS history
Timeline
  • 07 NOV 04:10Z
    Packagekit's apt backend lets user install untrusted local packages
    cvelistv5