CVE-2020-27351

Various memory and file descriptor leaks in apt-python

LOW

2.8

CVSS Score

Published: December 10, 2020 at 04:05 AM UTC

Updated: June 17, 2026 at 03:09 AM UTC

4 products affected across 3 vendorsAdvanced Package ToolDebian LinuxUbuntu Linux

Using python-apt by Canonical?

Get instant alerts when new vulnerabilities affect python-apt - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW2.8

Exploit prediction

EPSS 0.4%

Description

Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1;

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Advanced Package Tool · Debian

95%

v < 1.8.4.21.1.0~beta1 ≤ v < 1.1.0~beta1ubuntu0.16.04.101.6.5ubuntu0 ≤ v < 1.6.5ubuntu0.42.0.0ubuntu0 ≤ v < 2.0.0ubuntu0.20.04.22.1.3ubuntu1 ≤ v < 2.1.30ubuntu1.1

Affected range stops below 1.1.0~beta1ubuntu0.16.04.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.6.5ubuntu0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.8.4.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.0ubuntu0.20.04.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.30ubuntu1.1, so it looks safe — our inference, not a vendor statement

canonical-ubuntu-linux (environment) · debian-debian-linux (environment)

Python Apt · Ubuntu

60%

1.1.0~beta1 ≤ v < 1.1.0~beta1ubuntu0.16.04.101.6.5ubuntu0 ≤ v < 1.6.5ubuntu0.42.0.0ubuntu0 ≤ v < 2.0.0ubuntu0.20.04.22.1.3ubuntu1 ≤ v < 2.1.3ubuntu1.11.1.0~beta11.6.5ubuntu0 2.0.0ubuntu0 2.1.3ubuntu1

Affected range stops below 1.1.0~beta1ubuntu0.16.04.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.6.5ubuntu0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.0ubuntu0.20.04.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.3ubuntu1.1, so it looks safe — our inference, not a vendor statement

Ubuntu Linux · Canonicalrubygemsdevice

80%

All versions

Debian Linux · Debiandrupaldevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_MISCBroken Link

Source: [email protected]

https://bugs.launchpad.net/bugs/1899193

x_refsource_MISCVendor Advisory

Source: [email protected]

https://usn.ubuntu.com/usn/usn-4668-1

Vendor Advisoryx_refsource_DEBIAN

Source: [email protected]

https://www.debian.org/security/2020/dsa-4809

CVSS

2.8LOW[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: LOW

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-772

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card