PatchTheCVECVE-2020-11936: gdbus setgid privilege escalation
23
Routine
LOW 3.1DOWNGRADE
CVE-2020-11936 is a low-severity flaw (CVSS 3.1) affecting apport. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
gdbus setgid privilege escalation
Why this priority
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 3.1 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 72%) |
| CISA exploited list | No |
| Published | 2025-01-31 |
| Last modified | 2026-06-17 |
Publisher (CNA): Canonical Ltd. · Vendor: canonical
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
canonical apport DOWNGRADE
Affected: 2.20.1-0ubuntu1 · 2.20.1-0ubuntu2 · 2.20.1-0ubuntu2.1 · 2.20.1-0ubuntu2.2 · 2.20.1-0ubuntu2.4 · 2.20.1-0ubuntu2.5 · 2.20.1-0ubuntu2.6 · 2.20.1-0ubuntu2.7
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.20.1-0ubuntu1
1. Check installed version
apt-cache policy apport || rpm -q apport || apport --version
2. No fixed release: DOWNGRADE to a release before 2.20.1-0ubuntu1 (Debian / Ubuntu)
apt-cache madison apport
sudo apt install apport=<VERSION_BEFORE_2.20.1-0ubuntu1>
sudo apt-mark hold apport
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list apport
sudo dnf downgrade apport-<VERSION_BEFORE_2.20.1-0ubuntu1>
sudo dnf versionlock add apport
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11936?
apport: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-11936 being exploited?
CVE-2020-11936 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11936 affect?
CVE-2020-11936 affects apport. Severity is low (CVSS 3.1). gdbus setgid privilege escalation
How urgent is CVE-2020-11936?
Priority 23/100. Public exploit reference
Related CVEs
- CVE-2025-5467 LOW 3.3 UPGRADE It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create cr
- CVE-2025-5054 MEDIUM 4.7 UPGRADE MITIGATE Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive inform
- CVE-2023-1326 HIGH 7.7 UPGRADE MITIGATE A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604
- CVE-2022-28653 HIGH 7.5 UPGRADE Users can consume unlimited disk space in /var/crash
- CVE-2022-1242 HIGH 7.8 UPGRADE MITIGATE Apport can be tricked into connecting to arbitrary sockets as the root user