Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?

No word as of yet if Ubuntu's apt is also impacted.

Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.

It almost seems like a repeat of two previous apt vulnerabilities:

In 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...

> We recommend that you upgrade your apt packages.

Is there a German word for a broken tool that can only be fixed by using the same broken tool?