Description
apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 0.9.7.8 | — |
| Debian 13 | apt | 0.9.7.8 | — |
| Debian 12 | apt | 0.9.7.8 | — |
References
- 91428 vdb-entry
- USN-1762-1 vendor-advisory
- 52633 third-party-advisory