CVE-2020-27351: Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, pytho

Q: How do I fix CVE-2020-27351?

advanced package tool: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2020-27351 being exploited?

CVE-2020-27351 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2020-27351 affect?

CVE-2020-27351 affects advanced package tool. Severity is low (CVSS 2.0). Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ub

Q: How urgent is CVE-2020-27351?

Priority 20/100. On your watchlist

Routine

LOW 2.0WATCHLISTMITIGATE

CVE-2020-27351 is a low-severity flaw (CVSS 2.0) affecting advanced package tool. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1;

Why this priority

On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	2.0 (Low)
Attack vector	Local
Attack complexity	Low
Privileges needed	High
User interaction	Required
EPSS exploit chance	0.4% (top 66%)
CISA exploited list	No
Weakness	CWE-772
Published	2020-12-10
Last modified	2026-06-17

Publisher (CNA): Canonical Ltd. · Vendor: debian

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-12-10 04:15 UTCPublished CVE record published
2026-06-17 03:09 UTCUpdated Record last modified

debian advanced package tool MITIGATE

Affected: >= 1.1.0\~beta1 and < 1.1.0\~beta1ubuntu0.16.04.10 · >= 1.6.5ubuntu0 and < 1.6.5ubuntu0.4 · >= 2.0.0ubuntu0 and < 2.0.0ubuntu0.20.04.2 · >= 2.1.3ubuntu1 and < 2.1.30ubuntu1.1 · < 1.8.4.2

Fixed in: 1.1.0\~beta1ubuntu0.16.04.10, 1.6.5ubuntu0.4, 1.8.4.2, 2.0.0ubuntu0.20.04.2, 2.1.30ubuntu1.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy advanced-package-tool || rpm -q advanced-package-tool || advanced-package-tool --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-27351?

advanced package tool: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-27351 being exploited?

CVE-2020-27351 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-27351 affect?

CVE-2020-27351 affects advanced package tool. Severity is low (CVSS 2.0). Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ub

How urgent is CVE-2020-27351?

Priority 20/100. On your watchlist

Software pages

Python vulnerabilities · Debian vulnerabilities

Related CVEs

CVE-2020-27350 MEDIUM 5.7 UPGRADE MITIGATE APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169,
CVE-2019-3462 HIGH 8.1 UPGRADE MITIGATE Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can
CVE-2018-0501 MEDIUM 5.9 MITIGATE UPGRADE The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~a
CVE-2016-1252 MEDIUM 5.9 UPGRADE MITIGATE The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS be
CVE-2014-7206 LOW 3.6 UPGRADE DOWNGRADE The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attac

References

← Back to latest CVEs