CVE-2020-3810: canonical ubuntu_linux Improper Input Validation
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2020-3810USN-4359-1USN-4359-2DEBIAN-CVE-2020-3810DLA-2210-1DSA-4685-1
Published 15-05-2020Last modified 17-09-2024
Vulnerability summary
CVE-2020-3810 is a medium (CVSS 5.5) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 70.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
1.34%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 15-05-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
+0.03 pp
From 1.31% on 18-09-2026
18-09-202618-10-2026
EPSS score1.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundApt
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian3 products
- apt< 2.1.2 | < 1.4.10 | < 1.8.2.1 | < 1.0.9.8.6
- apt< 2.1.2
- debian_linuxEOL9.0 | 10.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.10 | 20.04
Fedoraproject1 product
- fedoraEOL32
Ubuntu1 product
- apt< 1.2.32ubuntu0.1 | < 1.6.12ubuntu0.1 | < 2.0.2ubuntu0.1 | < 1.0.1ubuntu2.24+esm1
4 vendors · 6 products
References
15 links
salsa.debian.org/apt-team/apt/-/commit/dceb1e49e4b8e4dadaf056be34088b415939cda6X Refsource MISCPatchVendor Advisory- lists.debian.org/debian-security-announce/2020/msg00089.htmlX Refsource MISCMailing ListVendor Advisory
- tracker.debian.org/news/1144109/accepted-apt-212-source-into-unstable/X Refsource MISCRelease NotesVendor Advisory