CVE-2021-32556: Canonical Apport

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.

Affected products

• Canonical Apport: from 2.14.1-0ubuntu3, before 2.14.1-0ubuntu3.29\+esm7 (fixed in 2.14.1-0ubuntu3.29\+esm7); from 2.20.1, before 2.20.1-0ubuntu2.30\+esm1 (fixed in 2.20.1-0ubuntu2.30\+esm1); from 2.20.9, before 2.20.9-0ubuntu7.24 (fixed in 2.20.9-0ubuntu7.24); from 2.20.11-0ubuntu27, before 2.20.11-0ubuntu27.18 (fixed in 2.20.11-0ubuntu27.18); from 2.20.11-0ubuntu50, before 2.20.11-0ubuntu50.7 (fixed in 2.20.11-0ubuntu50.7); from 2.20.11-0ubuntu65, before 2.20.11-0ubuntu65.1 (fixed in 2.20.11-0ubuntu65.1)

Published 2021-06-12. Last modified 2026-06-17.