9.3

CVE-2019-3462: canonical ubuntu_linux

CVSS: 9.3v2.0HighModified
AliasesUBUNTU-CVE-2019-3462USN-3863-1DEBIAN-CVE-2019-3462
Published 28-01-2019Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2019-3462 is a high (CVSS 9.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 14.56% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
14.56%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 28-01-2019
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

14.56%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 14.56% on 18-09-2026

18-09-202618-10-2026
EPSS score
14.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Debian3 products
Netapp2 products
Canonical1 product
Debian gnu/linux1 product
Ubuntu1 product
  • apt< 1.0.1ubuntu2.19 | < 1.2.29ubuntu0.1 | < 1.6.6ubuntu0.1

5 vendors · 8 products

References

13 links
Show all 13 references