Read the docs
TI-2020-12375 Aliases CVE-2020-15703GHSA-wpmr-q825-x4c6

aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property

Priority LOW 19CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.

Why it matters now

EPSS 0.0049 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed aptdaemon (Canonical): 1.1.1+bzr982-0ubuntu32.2, 1.1.1+bzr982-0ubuntu19.4, 1.1.1+bzr982-0ubuntu14.4aptdaemon (PyPI): 1.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalaptdaemonbefore 1.1.1+bzr982-0ubuntu32.2; before 1.1.1+bzr982-0ubuntu19.4; before 1.1.1+bzr982-0ubuntu14.41.1.1+bzr982-0ubuntu32.2, 1.1.1+bzr982-0ubuntu19.4, 1.1.1+bzr982-0ubuntu14.4Patch availableCNA
—aptdaemon (PyPI)before 1.1.11.1.1Patch availableGHSA-wpmr-q825-x4c6
  • aptdaemon VendorCanonical Affected before 1.1.1+bzr982-0ubuntu32.2; before 1.1.1+bzr982-0ubuntu19.4; before 1.1.1+bzr982-0ubuntu14.4 Fixed in 1.1.1+bzr982-0ubuntu32.2, 1.1.1+bzr982-0ubuntu19.4, 1.1.1+bzr982-0ubuntu14.4 Patch available CNA
  • aptdaemon (PyPI) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-wpmr-q825-x4c6

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu14.4:*:*:*:*:*:*1.1.1 bzr982-0ubuntu14.4VulnerableAptdaemon Project
cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu19.4:*:*:*:*:*:*1.1.1 bzr982-0ubuntu19.4VulnerableAptdaemon Project
cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu32.2:*:*:*:*:*:*1.1.1 bzr982-0ubuntu32.2VulnerableAptdaemon Project
  • cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu14.4:*:*:*:*:*:* Versions 1.1.1 bzr982-0ubuntu14.4 Vulnerable ·Aptdaemon Project
  • cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu19.4:*:*:*:*:*:* Versions 1.1.1 bzr982-0ubuntu19.4 Vulnerable ·Aptdaemon Project
  • cpe:2.3:a:aptdaemon_project:aptdaemon:1.1.1:bzr982-0ubuntu32.2:*:*:*:*:*:* Versions 1.1.1 bzr982-0ubuntu32.2 Vulnerable ·Aptdaemon Project

Remediation

  • Fix · CNA aptdaemon (Canonical) Fixed in 1.1.1+bzr982-0ubuntu32.2, 1.1.1+bzr982-0ubuntu19.4, 1.1.1+bzr982-0ubuntu14.4
  • Fix · GHSA-wpmr-q825-x4c6 aptdaemon (PyPI) Fixed in 1.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15703
  2. 2026-10-03 Alias added: GHSA-wpmr-q825-x4c6

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences