Medium severity · published Jan 23, 2020
CVE-2019-18899
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apt-cacher-ng · Apt-cacher-ng Project
before 3.1-lp151.3.3.1 · source: NVD
BA
Backports · Opensuse
sle-15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18899
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1157703
More from Apt-cacher-ng
6.1
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression
5.5
CVE-2020-5202
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port
5.4
CVE-2025-11147
Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1
5.4
CVE-2025-11146
Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1