Debian Releases Fix for Man-In-The-Middle Vulnerability Impacting APT

Debian has released a fix for the APT package manager, one that addresses a man-in-the-middle vulnerability.

APT is the primary package manager, or way of installing packages, on Debian and various Debian-based distros, such as Ubuntu, Linux Mint, Zorin OS, Tuxedo OS, and hundreds more. As such, a vulnerability impacting APT has the potential to be one of the worst kinds of vulnerabilities.

The announcement was made via the Debian security mailing list:

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.

As announced, anyone running Debian, or any impacted distro, should immediately update.