An exploit exists in APT, the package manager for Debian and Ubuntu, enabling an attacker who can modify downloaded packages to replace a verified package with their own This article explores package exploit. . This exploit requires APT to retry failed downloads, which it does by default starting from Debian 12 and Ubuntu 22.04 and later versions.
However, many user scripts might have enabled the retry setting, Acquire::Retries, on those releases, as stated by APT's developers.
Ubuntu classifies the flaw as a high priority, with a score of 7.7, and notes that distributions based on Debian and Ubuntu are affected without specifying any particular versions. Ubuntu has uploaded new APT builds for four of its releases to its security archive at 14:25 UTC on November 4: Ubuntu 26.10: version 3.3.3ubuntu0.1, Ubuntu 26.04 LTS: version 3.2.1ubuntu0.1, Ubuntu 24.04 LTS: version 2.8.4ubuntu0.1, and Ubuntu 22.04 LTS: version 2.4.15ubuntu0.1. Max Justicz disclosed the vulnerability.
None of the three advisory reports mention any attacks exploiting the flaw or provide a workaround for systems that cannot be updated yet.
