{
  "@context": "https://schema.org",
  "@id": "https://aggr.aymericbeaumet.com/items/lobste-rs/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt/#webpage",
  "@type": [
    "WebPage",
    "ArchiveComponent"
  ],
  "articleBody": "* * *\n\n- *To*: [debian-security-announce@lists.debian.org](mailto:debian-security-announce%40lists.debian.org)\n- *Subject*: \\[SECURITY\\] \\[DSA 6607-1\\] apt security update\n- *From*: Salvatore Bonaccorso <[carnil@debian.org](mailto:carnil%40debian.org)\\>\n- *Date*: Wed, 04 Nov 2026 12:07:32 +0000\n- *Message-id*: <[\\[🔎\\]](https://lists.debian.org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.debian.org) [E1xOZm8-00000002Ddo-3pY0@seger.debian.org](https://lists.debian.org/debian-security-announce/2026/msg00526.html)\\>\n- *Reply-to*: [debian-security-announce-request@lists.debian.org](mailto:debian-security-announce-request%40lists.debian.org)\n\n* * *\n\n```\n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6607-1                   security@debian.org\nhttps://www.debian.org/security/                     Salvatore Bonaccorso\nNovember 04, 2026                     https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage        : apt\nCVE ID         : CVE-2026-109518\n\nMax Justicz discovered a vulnerability in the APT package manager. APT\ncan merge two different package downloads after an HTTP redirect gives\nthem the same URI. Improper file handling when resuming an HTTP download\nallows a man-in-the-middle attacker to replace a package after\nverification, resulting in the execution of arbitrary code as root.\n\nFor the stable distribution (trixie), this problem has been fixed in\nversion 3.0.4. Additionally this update addresses several out-of-bounds\naccess issues.\n\nWe recommend that you upgrade your apt packages.\n\nFor the detailed security status of apt please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/apt\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh\n8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+\nlU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA\n9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD\nYTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk\nOXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8\niTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo\n+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf\nn85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf\nvT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm\nChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=\n=VlLy\n-----END PGP SIGNATURE-----\n```\n\n* * *\n\n**Reply to:**\n\n- [debian-security-announce@lists.debian.org](<mailto:debian-security-announce@lists.debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update>)\n- [Salvatore Bonaccorso (on-list)](<mailto:carnil@debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&cc=debian-security-announce@lists.debian.org>)\n- [Salvatore Bonaccorso (off-list)](<mailto:carnil@debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update>)\n\n* * *\n\n- Prev by Date: **[\\[SECURITY\\] \\[DSA 6606-1\\] squid security update](https://lists.debian.org/debian-security-announce/2026/msg00525.html)**\n- Next by Date: **[\\[SECURITY\\] \\[DSA 6608-1\\] puppet-agent security update](https://lists.debian.org/debian-security-announce/2026/msg00527.html)**\n- Previous by thread: **[\\[SECURITY\\] \\[DSA 6606-1\\] squid security update](https://lists.debian.org/debian-security-announce/2026/msg00525.html)**\n- Next by thread: **[\\[SECURITY\\] \\[DSA 6608-1\\] puppet-agent security update](https://lists.debian.org/debian-security-announce/2026/msg00527.html)**\n- Index(es):\n  - [**Date**](https://lists.debian.org/debian-security-announce/2026/mail2.html#00526)\n  - [**Thread**](https://lists.debian.org/debian-security-announce/2026/thrd2.html#00526)\n",
  "authors": [
    "lists.debian.org via gnyeki"
  ],
  "captured_at": "2026-11-06T18:21:10.909146084+00:00",
  "category": "news",
  "content_html": "<hr />\n<ul>\n<li><em>To</em>: <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce%40lists.debian.org\">debian-security-announce@lists.debian.org</a></li>\n<li><em>Subject</em>: [SECURITY] [DSA 6607-1] apt security update</li>\n<li><em>From</em>: Salvatore Bonaccorso &lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil%40debian.org\">carnil@debian.org</a>&gt;</li>\n<li><em>Date</em>: Wed, 04 Nov 2026 12:07:32 +0000</li>\n<li><em>Message-id</em>: &lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">[🔎]</a> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00526.html\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&gt;</li>\n<li><em>Reply-to</em>: <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce-request%40lists.debian.org\">debian-security-announce-request@lists.debian.org</a></li>\n</ul>\n<hr />\n<pre><code><span class=\"code-snippet\" data-language=\"YAML\"><span class=\"syntax-source syntax-yaml\"><span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--BEGIN PGP SIGNED MESSAGE-----</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Hash</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">SHA512</span>\n\n<span class=\"syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml\">-</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">-------------------------------------------------------------------------</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Debian Security Advisory DSA-6607-1                   security@debian.org</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://www.debian.org/security/                     Salvatore Bonaccorso</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">November 04, 2026                     https://www.debian.org/security/faq</span>\n<span class=\"syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml\">-</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">-------------------------------------------------------------------------</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Package</span></span>        <span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">apt</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">CVE ID</span></span>         <span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">CVE-2026-109518</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Max Justicz discovered a vulnerability in the APT package manager. APT</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">can merge two different package downloads after an HTTP redirect gives</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">them the same URI. Improper file handling when resuming an HTTP download</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">allows a man-in-the-middle attacker to replace a package after</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">verification, resulting in the execution of arbitrary code as root.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">For the stable distribution (trixie), this problem has been fixed in</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">version 3.0.4. Additionally this update addresses several out-of-bounds</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">access issues.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">We recommend that you upgrade your apt packages.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">For the detailed security status of apt please refer to</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">its security tracker page at</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://security-tracker.debian.org/tracker/apt</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Further information about Debian Security Advisories, how to apply</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">these updates to your system and frequently asked questions can be</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">found at</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://www.debian.org/security/</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Mailing list</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">debian-security-announce@lists.debian.org</span>\n<span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--BEGIN PGP SIGNATURE-----</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">=VlLy</span>\n<span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--END PGP SIGNATURE-----</span>\n</span></span></code></pre>\n<hr />\n<p><strong>Reply to:</strong></p>\n<ul>\n<li>[debian-security-announce@lists.debian.org](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce@lists.debian.org\">mailto:debian-security-announce@lists.debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li>\n<li>[Salvatore Bonaccorso (on-list)](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil@debian.org\">mailto:carnil@debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&amp;cc=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce@lists.debian.org\">debian-security-announce@lists.debian.org</a>&gt;)</li>\n<li>[Salvatore Bonaccorso (off-list)](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil@debian.org\">mailto:carnil@debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li>\n</ul>\n<hr />\n<ul>\n<li>Prev by Date: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00525.html\">[SECURITY] [DSA 6606-1] squid security update</a></strong></li>\n<li>Next by Date: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00527.html\">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li>\n<li>Previous by thread: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00525.html\">[SECURITY] [DSA 6606-1] squid security update</a></strong></li>\n<li>Next by thread: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00527.html\">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li>\n<li>Index(es):\n<ul>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/mail2.html#00526\"><strong>Date</strong></a></li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/thrd2.html#00526\"><strong>Thread</strong></a></li>\n</ul>\n</li>\n</ul>\n",
  "content_markdown": "* * *\n\n- *To*: [debian-security-announce@lists.debian.org](mailto:debian-security-announce%40lists.debian.org)\n- *Subject*: \\[SECURITY\\] \\[DSA 6607-1\\] apt security update\n- *From*: Salvatore Bonaccorso <[carnil@debian.org](mailto:carnil%40debian.org)\\>\n- *Date*: Wed, 04 Nov 2026 12:07:32 +0000\n- *Message-id*: <[\\[🔎\\]](https://lists.debian.org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.debian.org) [E1xOZm8-00000002Ddo-3pY0@seger.debian.org](https://lists.debian.org/debian-security-announce/2026/msg00526.html)\\>\n- *Reply-to*: [debian-security-announce-request@lists.debian.org](mailto:debian-security-announce-request%40lists.debian.org)\n\n* * *\n\n```\n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6607-1                   security@debian.org\nhttps://www.debian.org/security/                     Salvatore Bonaccorso\nNovember 04, 2026                     https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage        : apt\nCVE ID         : CVE-2026-109518\n\nMax Justicz discovered a vulnerability in the APT package manager. APT\ncan merge two different package downloads after an HTTP redirect gives\nthem the same URI. Improper file handling when resuming an HTTP download\nallows a man-in-the-middle attacker to replace a package after\nverification, resulting in the execution of arbitrary code as root.\n\nFor the stable distribution (trixie), this problem has been fixed in\nversion 3.0.4. Additionally this update addresses several out-of-bounds\naccess issues.\n\nWe recommend that you upgrade your apt packages.\n\nFor the detailed security status of apt please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/apt\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh\n8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+\nlU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA\n9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD\nYTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk\nOXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8\niTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo\n+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf\nn85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf\nvT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm\nChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=\n=VlLy\n-----END PGP SIGNATURE-----\n```\n\n* * *\n\n**Reply to:**\n\n- [debian-security-announce@lists.debian.org](<mailto:debian-security-announce@lists.debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update>)\n- [Salvatore Bonaccorso (on-list)](<mailto:carnil@debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&cc=debian-security-announce@lists.debian.org>)\n- [Salvatore Bonaccorso (off-list)](<mailto:carnil@debian.org?in-reply-to=<E1xOZm8-00000002Ddo-3pY0@seger.debian.org>&subject=Re:%20[SECURITY] [DSA 6607-1] apt security update>)\n\n* * *\n\n- Prev by Date: **[\\[SECURITY\\] \\[DSA 6606-1\\] squid security update](https://lists.debian.org/debian-security-announce/2026/msg00525.html)**\n- Next by Date: **[\\[SECURITY\\] \\[DSA 6608-1\\] puppet-agent security update](https://lists.debian.org/debian-security-announce/2026/msg00527.html)**\n- Previous by thread: **[\\[SECURITY\\] \\[DSA 6606-1\\] squid security update](https://lists.debian.org/debian-security-announce/2026/msg00525.html)**\n- Next by thread: **[\\[SECURITY\\] \\[DSA 6608-1\\] puppet-agent security update](https://lists.debian.org/debian-security-announce/2026/msg00527.html)**\n- Index(es):\n  - [**Date**](https://lists.debian.org/debian-security-announce/2026/mail2.html#00526)\n  - [**Thread**](https://lists.debian.org/debian-security-announce/2026/thrd2.html#00526)\n",
  "dateCreated": "2026-11-06T18:21:10.909146084+00:00",
  "date_created": "2026-11-04T13:36:43+00:00",
  "date_modified": "2026-11-04T13:36:43+00:00",
  "date_published": "2026-11-04T13:36:43+00:00",
  "description": "Comments",
  "external_url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html",
  "git": {
    "commit": "20068632b65d2830a2d54f25ca1d90d697bea2c0",
    "path": "items/lobste-rs/2026/11/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt.md",
    "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/20068632b65d2830a2d54f25ca1d90d697bea2c0/items/lobste-rs/2026/11/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt.md"
  },
  "id": "urn:aggr:item:8175e8ecdcffe22a6f34aacb39baa99f2c72d59f",
  "isBasedOn": {
    "@id": "https://lists.debian.org/debian-security-announce/2026/msg00526.html"
  },
  "mainEntity": {
    "@id": "https://lists.debian.org/debian-security-announce/2026/msg00526.html",
    "@type": "CreativeWork",
    "archivedAt": {
      "@id": "https://aggr.aymericbeaumet.com/items/lobste-rs/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt/#webpage"
    },
    "author": [
      {
        "@type": "Person",
        "name": "lists.debian.org via gnyeki"
      }
    ],
    "dateModified": "2026-11-04T13:36:43+00:00",
    "datePublished": "2026-11-04T13:36:43+00:00",
    "headline": "Man-in-the-middle arbitrary code execution in Debian’s apt",
    "timeRequired": "PT2M",
    "url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html",
    "wordCount": 383
  },
  "name": "Archived snapshot: Man-in-the-middle arbitrary code execution in Debian’s apt",
  "preview": null,
  "reading_minutes": 2,
  "replicated_at": null,
  "source": "lobste-rs",
  "source_name": "Lobsters: Top Stories of the Past Week",
  "summary": "Comments",
  "tags": [
    "linux",
    "security"
  ],
  "temporalCoverage": "2026-11-06T18:21:10.909146084+00:00",
  "title": "Man-in-the-middle arbitrary code execution in Debian’s apt",
  "url": "https://aggr.aymericbeaumet.com/items/lobste-rs/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt/",
  "word_count": 383
}