CVE-2020-16122
Fixed in a distro release EPSS <1%CVSS 8.2
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Products: packagekit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | packagekit | 1.2.1-1 |
| Debian 13 | packagekit | 1.2.1-1 |
| Debian 14 | packagekit | 1.2.1-1 |
| Debian 9 | packagekit | 1.1.5-2+deb9u2 |
| Ubuntu 16.04 LTS | packagekit | 0.8.17-4ubuntu6~gcc5.4ubuntu1.5 |
| Ubuntu 18.04 LTS | packagekit | 1.1.9-1ubuntu2.18.04.6 |
| Ubuntu 20.04 LTS | packagekit | 1.1.13-2ubuntu1.1 |