title: python-apt downloads from untrusted sources
description: Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
problem types: CWE-287 Improper Authentication
affected:
{
product: Python-apt
vendor: Canonical
versions:
lessThan: 0.8.3ubuntu7.5, status: affected, version: 0.8.3, versionType: custom
lessThan: 0.9.3.5ubuntu3+esm2, status: affected, version: 0.9.3.5, versionType: custom
lessThan: 1.1.0~beta1ubuntu0.16.04.7, status: affected, version: 1.1.0, versionType: custom
lessThan: 1.6.5ubuntu0.1, status: affected, version: 1.6.5, versionType: custom
lessThan: 1.9.0ubuntu1.2, status: affected, version: 1.9.0, versionType: custom
lessThan: 1.9.5, status: affected, version: 1.9.5, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]