Debian apt security update: man-in-the-middle arbitrary code execution

https://lists.debian.org/debian-security-announce/2026/msg00526.html

29•vesinisa•46m ago

Comments

hiddenvulkcan•37m ago

Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?

bradfa•12m ago

More likely just a man in the middle attack. Apt typically uses HTTP (no TLS) as the signatures give the security. But in this case it sounds like the vulnerability is that after a successful signature check the legit file can be overridden by the attacker through some HTTP shenanigans.

vesinisa•31m ago

No word as of yet if Ubuntu's apt is also impacted.

Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.

It almost seems like a repeat of two previous apt vulnerabilities:

In 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...

greggsy•27m ago

I thought there might be some kind of hash or signature, but I’m assuming that can be forged along with the main payload?

vesinisa•19m ago

From the short description in the advisory, would seem like the attacker can cause the tool to overwrite the file after signature verification.

angry_octet•10m ago

Despite with the 'no need for TLS, apt packages are signed' clowns would have you believe, you can usually point to a package mirror with https. This has the added advantage of preventing a mitm from knowing what packages you install or blocking selected packages.

anthk•7m ago

Every mirror will know that because of HTTPD logs.

greggsy•28m ago

> We recommend that you upgrade your apt packages.

Is there a German word for a broken tool that can only be fixed by using the same broken tool?

pllbnk•19m ago

Münchhausenwerkzeug.

ahofmann•16m ago

Well, of course there is "Selbstreparaturparadoxon", but nobody uses that. This is more like a Münchhausen-Problem, where Baron Münchhausen pulls himself out of the swamp by his own hair.

veeti•5m ago

For what it's worth there is an apt "Acquire::http::AllowRedirect" option that can be disabled.

12312987•19m ago

Debian is such a clown show. The SSL fiasco, apt over http, overpatching packages, allowing AI, kicking out packages over some lintian bullshit.

How are you going to update if apt is compromised?

qwert199•9m ago

An here we see: The Debian people never introspect or change, because they were the first ones in open source, have too much power and outnumber the critics.

Truth by flagging.

mariofdistrust•17m ago

yey, my computers and containers aren't vulnerable (^-^)

serbuvlad•7m ago

It's always been strange to me and I've been saying forever that I don't get why package repos don't use HTTPS.

ferngodfather•3m ago

I get it to a point because it can be a chicken and egg situation sometimes, but there has got to be a better way.

InsidiousWombat•2m ago

theoretical model means that the transfer method doesn't matter.

Of course, that breaks if implementation checks the signatures in wrong moment

flotzam•3m ago

Would it have killed them to give some guidance in the announcement how to securely update the apt package(s)?

If necessary, with instructions for downloading and verifying it out of band

Or maybe by passing a parameter to an old apt version that disables the vulnerable HTTP download resumption

InsidiousWombat•3m ago

interesting, why is verification not running after package is already on hard drive in full ?

AI is forcing us to pay off 40 years of technical debt

Nvidia RTX Spark encrypted firmware slows inference speed to 35% on Linux

Incident with Pull Requests, Git Operations and Issues

Verification Is Not Knowledge: Science needs more than answers

Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)

Jelly Sheet

Kitty 0.50

A map of 5000+ midterm ads

Debian apt security update: man-in-the-middle arbitrary code execution

Jailbreaking my car's navigation system just so I can change the time

Stringman, an $800 open-source room scale gripper robot

The lost malloc()

The Internals of PostgreSQL

Geoffrey Hinton: it might turn out we were better off without AI

Synaptics Appears to Use Legal Threats to Block Open-Source DisplayLink Driver

Show HN: Uncracked City, detective game where you question LLM suspects that lie

Show HN: HackerTV – HN's most-recommended Youtube videos as 24/7 TV channels

Fujifilm to boost tape production 5x as AI fuels archiving demand

C++26 Disapproved

Giant canyon on Mars is still tectonically active

Distinct cellular and genetic differences in colorectal cancer in young patients

Japan's Jimi 'Mundane' Halloween Costumes of 2026

Qwen 3.8 27B on my laptop can interpret model weights, too

Hackers hit French national blood bank

Arrows to arrows, categories to queries (2025)

How I use AI (Oct 2026)

Postman silently auto-installs AI plugins and attempts to share all API data

There is no posttraining data commons

Safari introduces Adaptive Dark Mode in 27.3

We're training a Figma-fluent editing model

Debian apt security update: man-in-the-middle arbitrary code execution

Comments

AI is forcing us to pay off 40 years of technical debt

Nvidia RTX Spark encrypted firmware slows inference speed to 35% on Linux

Incident with Pull Requests, Git Operations and Issues

Verification Is Not Knowledge: Science needs more than answers

Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)

Jelly Sheet

Kitty 0.50

A map of 5000+ midterm ads

Debian apt security update: man-in-the-middle arbitrary code execution

Jailbreaking my car's navigation system just so I can change the time

Stringman, an $800 open-source room scale gripper robot

The lost malloc()

The Internals of PostgreSQL

Geoffrey Hinton: it might turn out we were better off without AI

Synaptics Appears to Use Legal Threats to Block Open-Source DisplayLink Driver

Show HN: Uncracked City, detective game where you question LLM suspects that lie

Show HN: HackerTV – HN's most-recommended Youtube videos as 24/7 TV channels

Fujifilm to boost tape production 5x as AI fuels archiving demand

C++26 Disapproved

Giant canyon on Mars is still tectonically active

Distinct cellular and genetic differences in colorectal cancer in young patients

Japan's Jimi 'Mundane' Halloween Costumes of 2026

Qwen 3.8 27B on my laptop can interpret model weights, too

Hackers hit French national blood bank

Arrows to arrows, categories to queries (2025)

How I use AI (Oct 2026)

Postman silently auto-installs AI plugins and attempts to share all API data

There is no posttraining data commons

Safari introduces Adaptive Dark Mode in 27.3

We're training a Figma-fluent editing model