CVE-2020-16122

Name	CVE-2020-16122
Description	PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2399-1
Debian Bugs	972229

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
packagekit (PTS)	bullseye	1.2.2-2	fixed
	bookworm	1.2.6-5	fixed
	trixie	1.3.1-1	fixed
	forky, sid	1.3.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
packagekit	source	stretch	1.1.5-2+deb9u2		DLA-2399-1
packagekit	source	(unstable)	1.2.1-1			972229

[buster] - packagekit <no-dsa> (Minor issue)
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098