CVE-2019-15795

What it actually does

python-apt performs package integrity verification using only MD5 checksums in Version.fetch_binary() and Version.fetch_source(), permitting an on-path attacker to substitute a different package whose MD5 matches the expected value.

Why it matters to the business

Organizations using affected Ubuntu and Debian systems risk silent installation of tampered packages that can lead to full system compromise, data theft, or persistence without triggering normal package verification alerts.

How an attack unfolds

An attacker on the same network path intercepts HTTPS or HTTP traffic to package repositories during apt operations, replaces the requested .deb or source archive with a malicious version that carries an identical MD5 sum, and allows the client to accept and install the altered package because stronger integrity checks are absent.

How to fix it

Upgrade python-apt to one of the fixed releases 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, or 0.8.3ubuntu7.5 depending on the Ubuntu release in use; rebuild any custom images or containers with the patched version.

How to confirm the fix worked

Query the installed python-apt package version and confirm it matches or exceeds a listed fixed release; re-run apt operations while monitoring network traffic to verify that only packages with modern checksums (SHA256) are accepted.

Typical attack path

1. Establish network position between the victim host and package mirrors
2. Wait for or trigger apt update or install commands that invoke fetch_binary or fetch_source
3. Substitute a crafted package whose MD5 matches the repository metadata
4. Allow the package manager to complete installation of the malicious payload

How to detect it

Review apt history logs, dpkg logs, and any proxy or network-capture records for package fetches that occurred over untrusted networks; look for repeated MD5 verification entries without accompanying SHA256 checks around the time of suspected exposure.

What your security team should do

• Immediately patch python-apt across all Ubuntu and Debian fleets using the exact fixed versions supplied by the vendor
• Enable repository pinning and signed-by verification to reduce reliance on single checksum algorithms
• Scan package caches and installed file hashes for unexpected MD5-only matches that post-date the vulnerability disclosure
• Add the CVE to internal vulnerability tracking with an expedited remediation SLA given the package-manager attack surface