CVE-2020-27351

What it actually does

Memory and file descriptor leaks in apt-python parsing routines allow repeated operations to gradually exhaust system resources without releasing allocated memory or descriptors.

Why it matters to the business

Sustained use of affected package tools on long-running systems can lead to gradual resource exhaustion, causing operational slowdowns or service disruptions on package management workflows.

How an attack unfolds

An attacker with local access runs repeated apt or python-apt operations that trigger the leaky code paths in arfile, tag, or tarfile handling, accumulating unreleased memory and descriptors until availability impact occurs.

How to fix it

Upgrade python-apt to fixed versions: 1.1.0~beta1ubuntu0.16.04.10 or later, 1.6.5ubuntu0.4 or later, 2.0.0ubuntu0.20.04.2 or later, or 2.1.3ubuntu1.1 or later depending on the Ubuntu release in use.

How to confirm the fix worked

Verify installed python-apt package version against the fixed releases listed for each Ubuntu series and confirm no memory growth during repeated package parsing operations after upgrade.

Typical attack path

1. Obtain local user access on an affected system
2. Invoke python-apt functions or apt commands that parse archives repeatedly
3. Trigger resource accumulation through normal package operations or crafted inputs
4. Observe gradual memory or descriptor exhaustion leading to degraded service

How to detect it

Review system logs and process monitoring for unexpected growth in memory usage or open file descriptors during package management tasks; no specific exploitation artifacts are known.

What your security team should do

• Prioritize patching python-apt on all Ubuntu and Debian systems using package management tools
• Monitor for resource exhaustion symptoms on systems performing frequent package operations
• Apply updates within standard maintenance windows given low severity and lack of known active exploitation