CVE-2020-15709: add-apt-repository print ASNI terminal codes

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-05 · updated 2026-06-17
Weakness: CWE-20

Description

Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.

Affected products

Canonical add-apt-repository: from 0.92.37.0 before 0.92.37.8ubuntu0.1\~esm1; from 0.96.20.0 before 0.96.20.10; from 0.96.24.32.0 before 0.96.24.32.14; from 0.98.9.0 before 0.98.9.2 — fixed in 0.92.37.8ubuntu0.1\~esm1, 0.96.20.10, 0.96.24.32.14, 0.98.9.2

How to fix

Upgrade to a fixed version: Canonical add-apt-repository 0.92.37.8ubuntu0.1\~esm1, 0.96.20.10, 0.96.24.32.14, 0.98.9.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15709 or the next vulnerability affects your stack