A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.
The attacker’s code then runs as root, according to advisories that Debian, Ubuntu, and APT’s developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.
The attacker’s code then runs as root, according to advisories that Debian, Ubuntu, and APT’s developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and The Hacker News