CVE-2019-11480 - Ubuntu kernel snap build process could use unauthenticated sources

Back Back to CVE browser

HIGH

Ubuntu kernel snap build process could use unauthenticated sources

Published Apr 14, 2020

8.4

HIGH

CVSS 3.1

EPSS 0.51%

Description

The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16

Affected products

Vendor Canonical Product PC-Kernel Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2019-07-16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Canonical

PC-Kernel

n/a

Version	Status	Constraints
unspecified	affected	<=2019-07-16

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-345

CWE-353

References (3)

https://bugs.launchpad.net/bugs/1836041
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11480
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3153
Advisory

Link	Providers	Tags
https://bugs.launchpad.net/bugs/1836041		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11480		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3153		Advisory