Debian, Ubuntu and the APT developers disclosed a flaw in APT's retry-on-failure download handling that lets someone positioned between a system and its package mirror substitute a malicious package for the one that was requested. Because the substituted code then executes with root privileges, any system that retries failed downloads under the default settings shipped since Debian 12 is at risk. Admins are urged to apply the patches in the November 4 advisories rather than wait for routine update cycles.
// source: thehackernews.com ↗