{"containers": {"cna": {"affected": [{"product": "packagekit", "vendor": "PackageKit", "versions": [{"lessThan": "1.1.13-2ubuntu1.1", "status": "affected", "version": "1.1.13-2ubuntu", "versionType": "custom"}, {"lessThan": "1.1.9-1ubuntu2.18.04.6", "status": "affected", "version": "1.1.9-1ubuntu", "versionType": "custom"}, {"lessThan": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5", "status": "affected", "version": "0.8.17-4ubuntu", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"}], "datePublic": "2020-06-12T00:00:00", "descriptions": [{"lang": "en", "value": "PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-07T04:10:19", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"}], "source": {"advisory": "https://ubuntu.com/security/notices/USN-4538-1", "defect": ["https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"], "discovery": "EXTERNAL"}, "title": "Packagekit's apt backend lets user install untrusted local packages", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2020-06-12T00:00:00.000Z", "ID": "CVE-2020-16122", "STATE": "PUBLIC", "TITLE": "Packagekit's apt backend lets user install untrusted local packages"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "packagekit", "version": {"version_data": [{"version_affected": "<", "version_name": "1.1.13-2ubuntu", "version_value": "1.1.13-2ubuntu1.1"}, {"version_affected": "<", "version_name": "1.1.9-1ubuntu", "version_value": "1.1.9-1ubuntu2.18.04.6"}, {"version_affected": "<", "version_name": "0.8.17-4ubuntu", "version_value": "0.8.17-4ubuntu6~gcc5.4ubuntu1.5"}]}}]}, "vendor_name": "PackageKit"}]}}, "credit": [{"lang": "eng", "value": "Sami Niemim\u00e4ki and Esko J\u00e4rnfors"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098", "refsource": "MISC", "url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"}]}, "source": {"advisory": "https://ubuntu.com/security/notices/USN-4538-1", "defect": ["https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"], "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2020-16122", "datePublished": "2020-06-12T00:00:00", "dateReserved": "2020-07-29T00:00:00", "dateUpdated": "2020-11-07T04:10:19", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:*", "matchCriteriaId": "936ABEE2-1ADB-44EB-AF92-818E0CE9B893", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages."}, {"lang": "es", "value": "El backend apt de PackageKit trat\u00f3 err\u00f3neamente a todas las debs locales como confiables.&#xa0;El modelo de seguridad de apt se basa en la confianza del repositorio y no en el contenido de archivos individuales.&#xa0;En sitios con reglas PolicyKit configuradas, esto puede permitir a los usuarios instalar paquetes maliciosos"}], "id": "CVE-2020-16122", "lastModified": "2022-10-21T18:12:28.447", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2020-11-07T04:15:12.130", "references": [{"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}