CVE-2020-15709
add-apt-repository print ASNI terminal codes
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.98.9.2, 0.96.24.32.14, 0.96.20.10, 0.92.37.8ubuntu0.1~esm1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.
Timeline
- CVE published
- Record last updated
Affected versions
- Canonical add-apt-repository
fixed in 0.98.9.2; fixed in 0.96.24.32.14; fixed in 0.96.20.10; fixed in 0.92.37.8ubuntu0.1~esm1