Vulnerability · high
Debian and Ubuntu APT man-in-the-middle code execution flaw
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Debian and Ubuntu systems using APT to download packages over HTTP
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Full takeover
The Brief
- A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a verified package for their own.
- The attacker's code then runs as root, according to advisories published by Debian, Ubuntu and APT's developers on November 4.
- Commenters say APT downloads packages over plain HTTP, so a man-in-the-middle position is enough to exploit the flaw.
Why it matters
Any Debian or Ubuntu system that installs or updates packages over a network path an attacker can influence may run attacker code as root until APT is upgraded.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | APT is the package manager developers and ops teams use on Debian and Ubuntu. |
| Yes | Core infrastructure | APT is core package-management infrastructure that nearly every Debian and Ubuntu team runs. |
| Yes | Popular tool | APT is a mainstream package manager used across Debian and Ubuntu systems. |
| No | Exploited in the wild | Sources report the flaw and advisories only, with no observed attacks. |
| No | Public exploit | Sources describe the flaw and advisories; no published exploit or PoC is mentioned. |
| No | Remote, no login | Attack requires a man-in-the-middle position to modify package downloads, not unauthenticated network access alone. |
| Yes | Full takeover | The Hacker News: attacker's code runs as root after swapping a verified package. |
| No | Secrets exposed | Sources report code execution; no stolen credentials, keys or data are mentioned. |
| No | Supply chain | Sources describe a MitM package swap in transit, not a compromised legitimate project or build pipeline. |
| No | No fix yet | Debian, Ubuntu and APT developers published advisories on November 4, implying fixes; no source says unpatched. |
Timeline
Full coverage · 2 sources
What developers are saying
Based on 78 comments · Mostly critical
Commenters are alarmed that APT's HTTP handling can be exploited by a man-in-the-middle and see it as a repeat of earlier APT flaws. Many argue that package repositories should default to HTTPS, while a few recall that APT's developers had resisted HTTPS on the grounds that signatures were enough. Others criticise the lack of upgrade guidance and note that the fix may not yet cover older releases.
- HTTP instead of HTTPS40%
- Repeat of earlier APT flaws20%
- Redirect feature should be opt-in15%
- Fix availability for older releases15%
- Lack of upgrade guidance10%
In favour
- + Packages are signed with PGP, which earlier discussions treated as sufficient protection without HTTPS
Concerns
- − Plain HTTP lets a man-in-the-middle see which packages are downloaded and whether they are vulnerable
- − Repeated serious breakage of the redirect feature suggests it is risky and not clearly needed
- − Advisories gave no guidance on securely updating apt itself
- − Fixed version appears in trixie-security, but bookworm is not yet fixed
“Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?”
“I think this demonstrates exactly why everything should be https.”
“Since this is the second time the redirect feature was broken in a serious way and there is still no obvious need for it.. time to make it opt-in instead of opt-out?”
First seen · 2 sources · 78 comments · Full story page · How tiers are decided