Debian issues update for APT flaw allowing root code execution via man-in-the-middle attack

DSA-6607-1 fixes a flaw in APT◆ where two different package downloads can be merged after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, leading to arbitrary code execution as root. The advisory text gives no CVE identifier or fixed package version, so defenders should apply the Debian apt update and confirm the installed version against the Debian security tracker.

For security analysts · Written by AI from 1 source · Wrong?