Vulnerability · Published Sep 5, 2020 · Assigned by canonical
CVE-2020-15709add-apt-repository print ASNI terminal codes
Medium 5.5
In plain English
A medium-severity improper input validation in add-apt-repository from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | software-properties | no fix listed | DEBIAN-CVE-2020-15709 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical | add-apt-repository | 0.98.9.* – before 0.98.9.20.96.24.32.* – before 0.96.24.32.140.96.20.* – before 0.96.20.100.92.37.* – before 0.92.37.8ubuntu0.1~esm1 |
Weakness: CWE-20