Debian alert DLA-2074-1 (python-apt)

From:
             
 
Dylan Aïssi  <daissi@debian.org> 
To:
             
 
debian-lts-announce@lists.debian.org 
Subject:
             
 
[SECURITY] [DLA 2074-1] python-apt security update 
Date:
             
 
Thu, 23 Jan 2020 22:03:46 +0100
Message-ID:
             
 
 <CA+6XHwQDPLJDh4xx6f+n0bKC1S=c7OCEb3eqXisGoPZ7GVGeWA@mail.gmail.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : python-apt
Version        : 0.9.3.13
CVE ID         : CVE-2019-15795 CVE-2019-15796
Debian Bug     : 944696

Several issues have been found in python-apt, a python interface to libapt-pkg.

CVE-2019-15795

    It was discovered that python-apt would still use MD5 hashes to validate
    certain downloaded packages. If a remote attacker were able to perform a
    man-in-the-middle attack, this flaw could potentially be used to install
    altered packages.

CVE-2019-15796

    It was discovered that python-apt could install packages from untrusted
    repositories, contrary to expectations.

For Debian 8 "Jessie", these problems have been fixed in version
0.9.3.13.

We recommend that you upgrade your python-apt packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmjwHvQbeL0FugTpdYS7xYT4FD1QFAl4qCb4ACgkQYS7xYT4F
D1SRUxAAm8T2dGUU4rAyBZns88W5PS82XJEJsguqV3OUaYp2z4W+m1zOH8AIa5mk
JTTrkM32q0gnHomdcvc1y6Y8302zBETMVR2bxGc4E1xAuYkKcbAOoqzt4qS3cu7o
ABL9s+ma6rV3YTbxVmZJx6VvgBRKrcdtjDAx4raqN/IUMM6MTlyS34kTOnLqKaGk
QzgnrZGExMF4YCgFVeQ5c0fRZCHOtnBFJf4rHnc57zJth/crIhq2mwiPUBrQiWCa
HinKMcUlBCPF1sOvnNWYUrY608wHovGIc1hy82c2vb0iZHU3f53HRlBUCggJWKHa
CzvhPDuJB91BqJQis+qmgeEQ/AxNL+dDwzuzdEj2jE8LLR59eaoFAZhazCBgZW5P
TVjSgfHDzJq0zOL1Zj5Hocr345K7TQ5JKnsxwpLiSdya9/dMB1pmWXRAy47P0wHi
rfOml3i6097tYCwVGr3bAmmV/zgU8pqkxvYoNnW7i21Bb5284Bvn1iohGRqlGCp/
Q4BWAKnV6AZOMckbUFj9KVV/w7x9UMFnrc18Efe3S5RrPy5RdRBjij4/ZYFBUrMD
rSP6p07HjOM0ig7qdHwO/mBmxRUI7XmbOQuc3Vl3wzHTVtyQe0eK429GpBO0ykgK
x5x7tVp8b5UzOFEf7756d3gUXt2b1WRM4U6ayLFV3jnWOxvI7fI=
=mZDY
-----END PGP SIGNATURE-----