Packagekit's apt backend lets user install untrusted local packages
Priority LOW 36CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-345.
Summary
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Why it matters now
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed packagekit (PackageKit): 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PackageKit | packagekit | 1.1.13-2ubuntu to before 1.1.13-2ubuntu1.1; 1.1.9-1ubuntu to before 1.1.9-1ubuntu2.18.04.6; 0.8.17-4ubuntu to before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 | 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 | Patch available | CNA |
- packagekit VendorPackageKit Affected 1.1.13-2ubuntu to before 1.1.13-2ubuntu1.1; 1.1.9-1ubuntu to before 1.1.9-1ubuntu2.18.04.6; 0.8.17-4ubuntu to before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 Fixed in 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | PackageKit |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
- cpe:2.3:a:packagekit_project:packagekit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PackageKit
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
Remediation
- Fix · CNA packagekit (PackageKit) Fixed in 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6, 0.8.17-4ubuntu6~gcc5.4ubuntu1.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
PackageKit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5, 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-12680 PackageKit error messages leak presence and mimetype of files to unprivileged usersPriority LOW 16
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-16122
- 2026-10-03 Alias added: GHSA-jfj4-x686-g8vv
References
More Packagekit vulnerabilities
- TI-2026-30170 PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root CVSS 3.1HIGH 8.8
- TI-2018-01024 Improper authentication in Red Hat PackageKit CVSS 3.0MEDIUM 5.5
- TI-2011-02207 Incorrect permission assignment in packagekit CVSS 3.1MEDIUM 5.3
- TI-2022-00886 Information disclosure in PackageKit CVSS 3.1LOW 3.3
- TI-2020-12680 PackageKit error messages leak presence and mimetype of files to unprivileged users CVSS 3.1LOW 3.3
- TI-2024-00195 Packagekitd: use-after-free in idle function callback CVSS 3.1LOW 3.3
Sources
- CVE-2020-16122 · CVE Program
- CVE-2020-16122 · NVD
- FIRST EPSS
- GHSA-jfj4-x686-g8vv · GitHub Advisory Database · CC BY 4.0
- CVE-2020-16122 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences