{
  "description": "Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.",
  "feed_url": "https://aggr.aymericbeaumet.com/sources/lists.debian.org/feed.json",
  "home_page_url": "https://aggr.aymericbeaumet.com/sources/lists.debian.org/",
  "items": [
    {
      "authors": [
        {
          "name": "lists.debian.org via gnyeki"
        }
      ],
      "content_html": "<hr />\n<ul>\n<li><em>To</em>: <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce%40lists.debian.org\">debian-security-announce@lists.debian.org</a></li>\n<li><em>Subject</em>: [SECURITY] [DSA 6607-1] apt security update</li>\n<li><em>From</em>: Salvatore Bonaccorso &lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil%40debian.org\">carnil@debian.org</a>&gt;</li>\n<li><em>Date</em>: Wed, 04 Nov 2026 12:07:32 +0000</li>\n<li><em>Message-id</em>: &lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">[🔎]</a> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00526.html\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&gt;</li>\n<li><em>Reply-to</em>: <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce-request%40lists.debian.org\">debian-security-announce-request@lists.debian.org</a></li>\n</ul>\n<hr />\n<pre><code><span class=\"code-snippet\" data-language=\"YAML\"><span class=\"syntax-source syntax-yaml\"><span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--BEGIN PGP SIGNED MESSAGE-----</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Hash</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">SHA512</span>\n\n<span class=\"syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml\">-</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">-------------------------------------------------------------------------</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Debian Security Advisory DSA-6607-1                   security@debian.org</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://www.debian.org/security/                     Salvatore Bonaccorso</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">November 04, 2026                     https://www.debian.org/security/faq</span>\n<span class=\"syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml\">-</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">-------------------------------------------------------------------------</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Package</span></span>        <span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">apt</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">CVE ID</span></span>         <span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">CVE-2026-109518</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Max Justicz discovered a vulnerability in the APT package manager. APT</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">can merge two different package downloads after an HTTP redirect gives</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">them the same URI. Improper file handling when resuming an HTTP download</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">allows a man-in-the-middle attacker to replace a package after</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">verification, resulting in the execution of arbitrary code as root.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">For the stable distribution (trixie), this problem has been fixed in</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">version 3.0.4. Additionally this update addresses several out-of-bounds</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">access issues.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">We recommend that you upgrade your apt packages.</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">For the detailed security status of apt please refer to</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">its security tracker page at</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://security-tracker.debian.org/tracker/apt</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">Further information about Debian Security Advisories, how to apply</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">these updates to your system and frequently asked questions can be</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">found at</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">https://www.debian.org/security/</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\"><span class=\"syntax-entity syntax-name syntax-tag syntax-yaml\">Mailing list</span></span><span class=\"syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml\">:</span> <span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">debian-security-announce@lists.debian.org</span>\n<span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--BEGIN PGP SIGNATURE-----</span>\n\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=</span>\n<span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">=VlLy</span>\n<span class=\"syntax-entity syntax-other syntax-document syntax-begin syntax-yaml\">---</span><span class=\"syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml\">--END PGP SIGNATURE-----</span>\n</span></span></code></pre>\n<hr />\n<p><strong>Reply to:</strong></p>\n<ul>\n<li>[debian-security-announce@lists.debian.org](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce@lists.debian.org\">mailto:debian-security-announce@lists.debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li>\n<li>[Salvatore Bonaccorso (on-list)](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil@debian.org\">mailto:carnil@debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&amp;cc=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:debian-security-announce@lists.debian.org\">debian-security-announce@lists.debian.org</a>&gt;)</li>\n<li>[Salvatore Bonaccorso (off-list)](&lt;<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:carnil@debian.org\">mailto:carnil@debian.org</a>?in-reply-to=<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org\">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li>\n</ul>\n<hr />\n<ul>\n<li>Prev by Date: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00525.html\">[SECURITY] [DSA 6606-1] squid security update</a></strong></li>\n<li>Next by Date: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00527.html\">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li>\n<li>Previous by thread: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00525.html\">[SECURITY] [DSA 6606-1] squid security update</a></strong></li>\n<li>Next by thread: <strong><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/msg00527.html\">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li>\n<li>Index(es):\n<ul>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/mail2.html#00526\"><strong>Date</strong></a></li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://lists.debian.org/debian-security-announce/2026/thrd2.html#00526\"><strong>Thread</strong></a></li>\n</ul>\n</li>\n</ul>\n",
      "date_modified": "2026-11-04T13:36:43+00:00",
      "date_published": "2026-11-04T13:36:43+00:00",
      "external_url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html",
      "id": "urn:aggr:item:8175e8ecdcffe22a6f34aacb39baa99f2c72d59f",
      "summary": "Comments",
      "tags": [
        "news",
        "linux",
        "security"
      ],
      "title": "Man-in-the-middle arbitrary code execution in Debian’s apt",
      "url": "https://aggr.aymericbeaumet.com/items/lobste-rs/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt/"
    }
  ],
  "language": "en",
  "title": "lists.debian.org",
  "version": "https://jsonfeed.org/version/1.1"
}