{"cve":"CVE-2020-5202","nvd":{"published":"2020-01-21T18:15:13.060","modified":"2026-06-17T03:21:00.860","status":"Modified","description":"apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":[],"references":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html","http://www.openwall.com/lists/oss-security/2020/01/20/4","http://www.openwall.com/lists/oss-security/2020/01/20/4","http://www.openwall.com/lists/oss-security/2020/01/20/4"],"products":["apt-cacher-ng_project:apt-cacher-ng","debian:debian_linux","opensuse:backports","opensuse:leap"],"source":"nvd","synced_at":"2026-10-19T21:01:01.339895972+00:00"},"epss":{"cve":"CVE-2020-5202","score":0.00469,"percentile":0.40597,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}