Vulnerability · Published Aug 6, 2020 · Assigned by canonical

CVE-2020-15701Unhandled exception in apport

Medium 5.5

In plain English

A medium-severity security flaw in apport from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6.

Affected products (as reported)

Vendor	Product	Versions
Canonical	apport	2.20.1 – before 2.20.1-0ubuntu2.242.20.9 – before 2.20.9-0ubuntu7.162.20.11 – before 2.20.11-0ubuntu27.6

Weakness: CWE-755 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://usn.ubuntu.com/4449-1 x_refsource_CONFIRM
https://launchpad.net/bugs/1877023 x_refsource_CONFIRM
USN-4449-1 vendor-advisory, x_refsource_UBUNTU
USN-4449-2 vendor-advisory, x_refsource_UBUNTU