CVE-2019-11480
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16
Scoring
- Severity
- HIGH
- CVSS base score
- 8.4
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.43%
- CWE
- CWE-353
- Published
- 2020-04-14
- Last modified
- 2026-03-14
Affected products
- Canonical pc-kernel
Weakness type
Related vulnerabilities
- CVE-2021-26608 — handysoft groupware arbitrary file download and execution vulnerability
- CVE-2020-7810 — HandySoft ActiveX File Download and Execution Vulnerability
- CVE-2020-10266 — RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot
- CVE-2020-7808 — RAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability
- CVE-2021-28545 — Acrobat Reader DC Missing Support for Integrity Check
- CVE-2019-12804 — Hunesion i-oneNet Missing Support for Integrity Check vulnerability
- CVE-2023-32475 — Dell BIOS contains a missing support for integrity check vulnerability. An attacker with physical access to the system c
- CVE-2025-48500 — BIG-IP APM VPN web client for macOS vulnerability