CybersecurityUpdated November 4

Debian’s APT update addresses a package-download flaw.

APT is the package manager for Debian and Ubuntu, and here a failed download can be the start of a more dangerous step. An attacker must be able to modify package downloads, and APT must retry after a download fails. If both conditions are met, the attacker can swap a package APT has checked for one of their own; its code can then run as root. The Hacker News reports that Debian, Ubuntu and APT’s developers published advisories on November 4, and that failed-download retries are enabled by default in Debian 12.

2 publishers2 reports

Coverage started November 4