Read the docs
TI-2025-06335 Aliases CVE-2025-6966GHSA-285f-828q-q7g5

Null-pointer dereference in python-apt TagSection.keys()

Priority LOW 29CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed python-apt (Canonical): 3.0.0ubuntu1.1, 3.0.0ubuntu0.25.04.1, 2.7.7ubuntu5.1 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalpython-apt3.0 to before 3.0.0ubuntu1.1; 3.0 to before 3.0.0ubuntu0.25.04.1; 2.7 to before 2.7.7ubuntu5.1; 2.4 to before 2.4.0ubuntu4.1; 2.0 to before 2.0.1ubuntu0.20.04.1+esm1; 1.6 to before 1.6.6ubuntu0.1~esm1; 1.1 to before 1.1.0~beta1ubuntu0.16.04.12+esm1; before 0.9.3.5ubuntu3+esm53.0.0ubuntu1.1, 3.0.0ubuntu0.25.04.1, 2.7.7ubuntu5.1, 2.4.0ubuntu4.1, 2.0.1ubuntu0.20.04.1+esm1, 1.6.6ubuntu0.1~esm1, 1.1.0~beta1ubuntu0.16.04.12+esm1, 0.9.3.5ubuntu3+esm5Patch availableCNA
  • python-apt VendorCanonical Affected 3.0 to before 3.0.0ubuntu1.1; 3.0 to before 3.0.0ubuntu0.25.04.1; 2.7 to before 2.7.7ubuntu5.1; 2.4 to before 2.4.0ubuntu4.1; 2.0 to before 2.0.1ubuntu0.20.04.1+esm1; 1.6 to before 1.6.6ubuntu0.1~esm1; 1.1 to before 1.1.0~beta1ubuntu0.16.04.12+esm1; before 0.9.3.5ubuntu3+esm5 Fixed in 3.0.0ubuntu1.1, 3.0.0ubuntu0.25.04.1, 2.7.7ubuntu5.1, 2.4.0ubuntu4.1, 2.0.1ubuntu0.20.04.1+esm1, 1.6.6ubuntu0.1~esm1, 1.1.0~beta1ubuntu0.16.04.12+esm1, 0.9.3.5ubuntu3+esm5 Patch available CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:ubuntu:python-apt:*:*:*:*:*:*:*:*before 0.9.3.11; 1.6.0 to before 1.6.6; 2.0.0 to before 2.0.1; 2.7.0 to before 2.7.7VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:0.9.3.5:ubuntu1:*:*:*:*:*:*0.9.3.5 ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:0.9.3.5:ubuntu2:*:*:*:*:*:*0.9.3.5 ubuntu2VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:0.9.3.11:-:*:*:*:*:*:*0.9.3.11VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:0.9.3.11:build1:*:*:*:*:*:*0.9.3.11 build1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1:*:*:*:*:*:*1.1.0 beta1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1build1:*:*:*:*:*:*1.1.0 beta1build1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.1:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.10:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.10VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.11:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.11VulnerableUbuntu
  • cpe:2.3:a:ubuntu:python-apt:*:*:*:*:*:*:*:* Versions before 0.9.3.11; 1.6.0 to before 1.6.6; 2.0.0 to before 2.0.1; 2.7.0 to before 2.7.7 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:0.9.3.5:ubuntu1:*:*:*:*:*:* Versions 0.9.3.5 ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:0.9.3.5:ubuntu2:*:*:*:*:*:* Versions 0.9.3.5 ubuntu2 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:0.9.3.11:-:*:*:*:*:*:* Versions 0.9.3.11 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:0.9.3.11:build1:*:*:*:*:*:* Versions 0.9.3.11 build1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1:*:*:*:*:*:* Versions 1.1.0 beta1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1build1:*:*:*:*:*:* Versions 1.1.0 beta1build1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.1:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.10:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.10 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.11:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.11 Vulnerable ·Ubuntu
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.2:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.2VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.3:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.3VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.4:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.4VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.5:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.5VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.7:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.7VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.8:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.8VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.9:*:*:*:*:*:*1.1.0 beta1ubuntu0.16.04.9VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta2ubuntu1:*:*:*:*:*:*1.1.0 beta2ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta3:*:*:*:*:*:*1.1.0 beta3VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta4:*:*:*:*:*:*1.1.0 beta4VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta4ubuntu1:*:*:*:*:*:*1.1.0 beta4ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta5:*:*:*:*:*:*1.1.0 beta5VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.1.0:beta5ubuntu1:*:*:*:*:*:*1.1.0 beta5ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:1.6.6:-:*:*:*:*:*:*1.6.6VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.0.1:-:*:*:*:*:*:*2.0.1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:\+22.10:*:*:*:*:*:*2.4.0 \+22.10VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:-:*:*:*:*:*:*2.4.0VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu1:*:*:*:*:*:*2.4.0 ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu2:*:*:*:*:*:*2.4.0 ubuntu2VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu3:*:*:*:*:*:*2.4.0 ubuntu3VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu4:*:*:*:*:*:*2.4.0 ubuntu4VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:-:*:*:*:*:*:*2.7.7VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:build1:*:*:*:*:*:*2.7.7 build1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu1:*:*:*:*:*:*2.7.7 ubuntu1VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu2:*:*:*:*:*:*2.7.7 ubuntu2VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu3:*:*:*:*:*:*2.7.7 ubuntu3VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu4:*:*:*:*:*:*2.7.7 ubuntu4VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu5:*:*:*:*:*:*2.7.7 ubuntu5VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:3.0.0:-:*:*:*:*:*:*3.0.0VulnerableUbuntu
cpe:2.3:a:ubuntu:python-apt:3.0.0:ubuntu1:*:*:*:*:*:*3.0.0 ubuntu1VulnerableUbuntu
cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*not specified by NVDRunning onCanonical
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.2:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.2 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.3:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.3 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.4:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.4 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.5:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.5 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.7:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.7 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.8:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.8 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta1ubuntu0.16.04.9:*:*:*:*:*:* Versions 1.1.0 beta1ubuntu0.16.04.9 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta2ubuntu1:*:*:*:*:*:* Versions 1.1.0 beta2ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta3:*:*:*:*:*:* Versions 1.1.0 beta3 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta4:*:*:*:*:*:* Versions 1.1.0 beta4 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta4ubuntu1:*:*:*:*:*:* Versions 1.1.0 beta4ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta5:*:*:*:*:*:* Versions 1.1.0 beta5 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.1.0:beta5ubuntu1:*:*:*:*:*:* Versions 1.1.0 beta5ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:1.6.6:-:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.0.1:-:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:\+22.10:*:*:*:*:*:* Versions 2.4.0 \+22.10 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:-:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu1:*:*:*:*:*:* Versions 2.4.0 ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu2:*:*:*:*:*:* Versions 2.4.0 ubuntu2 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu3:*:*:*:*:*:* Versions 2.4.0 ubuntu3 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.4.0:ubuntu4:*:*:*:*:*:* Versions 2.4.0 ubuntu4 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:-:*:*:*:*:*:* Versions 2.7.7 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:build1:*:*:*:*:*:* Versions 2.7.7 build1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu1:*:*:*:*:*:* Versions 2.7.7 ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu2:*:*:*:*:*:* Versions 2.7.7 ubuntu2 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu3:*:*:*:*:*:* Versions 2.7.7 ubuntu3 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu4:*:*:*:*:*:* Versions 2.7.7 ubuntu4 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:2.7.7:ubuntu5:*:*:*:*:*:* Versions 2.7.7 ubuntu5 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:3.0.0:-:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Ubuntu
  • cpe:2.3:a:ubuntu:python-apt:3.0.0:ubuntu1:*:*:*:*:*:* Versions 3.0.0 ubuntu1 Vulnerable ·Ubuntu
  • cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canonical
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA python-apt (Canonical) Fixed in 3.0.0ubuntu1.1, 3.0.0ubuntu0.25.04.1, 2.7.7ubuntu5.1, 2.4.0ubuntu4.1, 2.0.1ubuntu0.20.04.1+esm1, 1.6.6ubuntu0.1~esm1, 1.1.0~beta1ubuntu0.16.04.12+esm1, 0.9.3.5ubuntu3+esm5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-6966
  2. 2026-10-03 Alias added: GHSA-285f-828q-q7g5

References

Exploit 1

Advisory 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences