PackageKit error messages leak presence and mimetype of files to unprivileged users
Priority LOW 16CWE-209Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-209.
Summary
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
Why it matters now
EPSS 0.00468 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial PackageKit (PackageKit): 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5Red Hat: 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PackageKit | PackageKit | 1.1.13-2ubuntu to before 1.1.13-2ubuntu1.1; 1.1.9-1ubuntu2 to before 1.1.9-1ubuntu2.18.04.6; 0.8.17-4ubuntu6 to before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 | 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 | Patch available | CNA |
- PackageKit VendorPackageKit Affected 1.1.13-2ubuntu to before 1.1.13-2ubuntu1.1; 1.1.9-1ubuntu2 to before 1.1.9-1ubuntu2.18.04.6; 0.8.17-4ubuntu6 to before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 Fixed in 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | PackageKit |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
- cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PackageKit
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
Remediation
- Fix · CNA PackageKit (PackageKit) Fixed in 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
PackageKit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5, 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-12681 Packagekit's apt backend lets user install untrusted local packagesPriority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-16121
- 2026-10-03 Alias added: GHSA-6g23-6jw5-9vrf
References
More Packagekit vulnerabilities
- TI-2026-30170 PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root CVSS 3.1HIGH 8.8
- TI-2020-12681 Packagekit's apt backend lets user install untrusted local packages CVSS 3.1HIGH 8.2
- TI-2018-01024 Improper authentication in Red Hat PackageKit CVSS 3.0MEDIUM 5.5
- TI-2011-02207 Incorrect permission assignment in packagekit CVSS 3.1MEDIUM 5.3
- TI-2022-00886 Information disclosure in PackageKit CVSS 3.1LOW 3.3
- TI-2024-00195 Packagekitd: use-after-free in idle function callback CVSS 3.1LOW 3.3
Sources
- CVE-2020-16121 · CVE Program
- CVE-2020-16121 · NVD
- FIRST EPSS
- GHSA-6g23-6jw5-9vrf · GitHub Advisory Database · CC BY 4.0
- CVE-2020-16121 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences