alt Hacker NewsNo word as of yet if Ubuntu's apt is also impacted.
Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.
It almost seems like a repeat of two previous apt vulnerabilities:
In 2019: https://lists.debian.org/debian-security-announce/2019/msg00...
And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...
Replies
Despite with the 'no need for TLS, apt packages are signed' clowns would have you believe, you can usually point to a package mirror with https. This has the added advantage of preventing a mitm from knowing what packages you install or blocking selected packages.
I thought there might be some kind of hash or signature, but I’m assuming that can be forged along with the main payload?
> Updates for the affected Debian, Debian LTS, Debian eLTS, Ubuntu, and Ubuntu Pro channels are being released. > > An update for apt 1.0.1ubuntu2.24 has been made available to Ubuntu Pro customers running Ubuntu "trusty" through the Ubuntu Pro subscription service, and a 3.3.3ubuntu0.1 for stonking.
From the original disclosure: https://lists.debian.org/deity/2026/11/msg00005.html
For context, Ubuntu trusty and apt 1.0.1 is from 2014.