Vulnerability · Published Dec 10, 2020 · Assigned by canonical

CVE-2020-27350apt integer wraparound

Medium 5.7

In plain English

A medium-severity integer overflow in apt from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	apt	2.1.13	DEBIAN-CVE-2020-27350
Debian:13	apt	2.1.13	DEBIAN-CVE-2020-27350
Debian:14	apt	2.1.13	DEBIAN-CVE-2020-27350

Affected products (as reported)

Vendor	Product	Versions
Canonical	apt	1.2.32ubuntu0 – before 1.2.32ubuntu0.21.6.12ubuntu0 – before 1.6.12ubuntu0.22.0.2ubuntu0 – before 2.0.2ubuntu0.22.1.10ubuntu0 – before 2.1.10ubuntu0.1

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

https://usn.ubuntu.com/usn/usn-4667-1 x_refsource_MISC
https://bugs.launchpad.net/bugs/1899193 x_refsource_MISC
DSA-4808 vendor-advisory, x_refsource_DEBIAN
https://security.netapp.com/advisory/ntap-20210108-0005/ x_refsource_CONFIRM