Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

Apt Can Read Files as Root Due to Unvalidated Input

CVE-2020-15703 · published 6 years ago
Summary

An attacker can trick Apt into reading system files by manipulating a specific input field. This could potentially allow them to access sensitive data. Users should update Apt to the latest version to fix this issue.

What to do
  • Update sebastian heinlein aptdaemon to version 1.1.1.
Affected software
Ecosystem VendorProductAffected versions
– aptdaemon_project aptdaemon 1.1.1
cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu14.4:*:*:*:*:*:*
pip sebastian heinlein aptdaemon < 1.1.1
Fix: upgrade to 1.1.1
Original advisory text
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink...
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-22Path Traversal
Timeline
Published31 Oct 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-wpmr-q825-x4c6 · GHSA
CVE-2020-15703 · NVD
Track software like this
Free during beta