https://aggr.aymericbeaumet.com/sources/lists.debian.org/ Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr. en Wed, 4 Nov 2026 13:36:43 +0000 aggr https://aggr.aymericbeaumet.com/items/lobste-rs/2026-11-04-man-in-the-middle-arbitrary-code-execution-in-debian-s-apt/ urn:aggr:item:8175e8ecdcffe22a6f34aacb39baa99f2c72d59f Wed, 4 Nov 2026 13:36:43 +0000 lists.debian.org via gnyeki Comments <hr /> <ul> <li><em>To</em>: <a target="_blank" rel="noopener noreferrer" href="mailto:debian-security-announce%40lists.debian.org">debian-security-announce@lists.debian.org</a></li> <li><em>Subject</em>: [SECURITY] [DSA 6607-1] apt security update</li> <li><em>From</em>: Salvatore Bonaccorso &lt;<a target="_blank" rel="noopener noreferrer" href="mailto:carnil%40debian.org">carnil@debian.org</a>&gt;</li> <li><em>Date</em>: Wed, 04 Nov 2026 12:07:32 +0000</li> <li><em>Message-id</em>: &lt;<a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.debian.org">[🔎]</a> <a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/msg00526.html">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&gt;</li> <li><em>Reply-to</em>: <a target="_blank" rel="noopener noreferrer" href="mailto:debian-security-announce-request%40lists.debian.org">debian-security-announce-request@lists.debian.org</a></li> </ul> <hr /> <pre><code><span class="code-snippet" data-language="YAML"><span class="syntax-source syntax-yaml"><span class="syntax-entity syntax-other syntax-document syntax-begin syntax-yaml">---</span><span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">--BEGIN PGP SIGNED MESSAGE-----</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">Hash</span></span><span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">SHA512</span> <span class="syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml">-</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">-------------------------------------------------------------------------</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">Debian Security Advisory DSA-6607-1 security@debian.org</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">https://www.debian.org/security/ Salvatore Bonaccorso</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">November 04, 2026 https://www.debian.org/security/faq</span> <span class="syntax-punctuation syntax-definition syntax-block syntax-sequence syntax-item syntax-yaml">-</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">-------------------------------------------------------------------------</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">Package</span></span> <span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">apt</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">CVE ID</span></span> <span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">CVE-2026-109518</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">Max Justicz discovered a vulnerability in the APT package manager. APT</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">can merge two different package downloads after an HTTP redirect gives</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">them the same URI. Improper file handling when resuming an HTTP download</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">allows a man-in-the-middle attacker to replace a package after</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">verification, resulting in the execution of arbitrary code as root.</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">For the stable distribution (trixie), this problem has been fixed in</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">version 3.0.4. Additionally this update addresses several out-of-bounds</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">access issues.</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">We recommend that you upgrade your apt packages.</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">For the detailed security status of apt please refer to</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">its security tracker page at</span></span><span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">https://security-tracker.debian.org/tracker/apt</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">Further information about Debian Security Advisories, how to apply</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">these updates to your system and frequently asked questions can be</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">found at</span></span><span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">https://www.debian.org/security/</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml"><span class="syntax-entity syntax-name syntax-tag syntax-yaml">Mailing list</span></span><span class="syntax-punctuation syntax-separator syntax-key-value syntax-mapping syntax-yaml">:</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">debian-security-announce@lists.debian.org</span> <span class="syntax-entity syntax-other syntax-document syntax-begin syntax-yaml">---</span><span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">--BEGIN PGP SIGNATURE-----</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=</span> <span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">=VlLy</span> <span class="syntax-entity syntax-other syntax-document syntax-begin syntax-yaml">---</span><span class="syntax-string syntax-unquoted syntax-plain syntax-out syntax-yaml">--END PGP SIGNATURE-----</span> </span></span></code></pre> <hr /> <p><strong>Reply to:</strong></p> <ul> <li>[debian-security-announce@lists.debian.org](&lt;<a target="_blank" rel="noopener noreferrer" href="mailto:debian-security-announce@lists.debian.org">mailto:debian-security-announce@lists.debian.org</a>?in-reply-to=<a target="_blank" rel="noopener noreferrer" href="mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li> <li>[Salvatore Bonaccorso (on-list)](&lt;<a target="_blank" rel="noopener noreferrer" href="mailto:carnil@debian.org">mailto:carnil@debian.org</a>?in-reply-to=<a target="_blank" rel="noopener noreferrer" href="mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&amp;cc=<a target="_blank" rel="noopener noreferrer" href="mailto:debian-security-announce@lists.debian.org">debian-security-announce@lists.debian.org</a>&gt;)</li> <li>[Salvatore Bonaccorso (off-list)](&lt;<a target="_blank" rel="noopener noreferrer" href="mailto:carnil@debian.org">mailto:carnil@debian.org</a>?in-reply-to=<a target="_blank" rel="noopener noreferrer" href="mailto:E1xOZm8-00000002Ddo-3pY0@seger.debian.org">E1xOZm8-00000002Ddo-3pY0@seger.debian.org</a>&amp;subject=Re:%20[SECURITY] [DSA 6607-1] apt security update&gt;)</li> </ul> <hr /> <ul> <li>Prev by Date: <strong><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/msg00525.html">[SECURITY] [DSA 6606-1] squid security update</a></strong></li> <li>Next by Date: <strong><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/msg00527.html">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li> <li>Previous by thread: <strong><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/msg00525.html">[SECURITY] [DSA 6606-1] squid security update</a></strong></li> <li>Next by thread: <strong><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/msg00527.html">[SECURITY] [DSA 6608-1] puppet-agent security update</a></strong></li> <li>Index(es): <ul> <li><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/mail2.html#00526"><strong>Date</strong></a></li> <li><a target="_blank" rel="noopener noreferrer" href="https://lists.debian.org/debian-security-announce/2026/thrd2.html#00526"><strong>Thread</strong></a></li> </ul> </li> </ul> news linux security