APT flaw lets whoever can tamper with downloads swap a verified package for their own

Debian, Ubuntu and the APT developers published advisories on November 4 for a flaw in APT, the package manager both distributions use. An attacker who can modify package downloads can swap a package that has already been checked for one of their own, and that code then runs as root.

The attack needs two things. First, a position where the attacker can alter what APT fetches, a man-in-the-middle spot on the network path. Second, APT has to retry a failed download, which the reporting says it does by default from Debian 12 onward. Take either away and the described chain doesn't apply.

That's a narrower set of conditions than "any Debian or Ubuntu box is rootable", and it's worth keeping the two apart. A machine pulling packages over a hostile network, or one whose mirror traffic someone can intercept, is the case to think about. The advisories don't say whether anyone has used this in the wild, and we haven't seen a public write-up yet.

If you run Debian or Ubuntu, check the fixed APT version your distribution names in its advisory and get to it. Until then, fetching over a path you trust is the obvious mitigation. We'd treat the retry behaviour as the part to read closely, since it's what turns a failed download into a second chance for the attacker.

The source text we have is a summary of the three advisories, not the advisories themselves. Version ranges and the exact fix belong in those documents.