Information disclosure in Packagekit
CVE-2020-16121
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
EPSS: 0.005 (37.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Packagekit — versions 1.1.13-2ubuntu, 1.1.9-1ubuntu2, 0.8.17-4ubuntu6
- Packagekit_project Packagekit
- Canonical Ubuntu_linux — versions 20.04
Weakness classification (CWE)
References
- security@ubuntu.com (Exploit, Third Party Advisory, x_refsource_MISC)
- security@ubuntu.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2020-16121?
- CVE-2020-16121 is a low-severity vulnerability in Packagekit, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 3.3/10. Published 2020-11-07.
- How severe is CVE-2020-16121?
- Low severity. CVSS v3 base score is 3.3 out of 10.