Post by @whitequark@social.treehouse.systems

✧✦Catherine✦✧

@whitequark@social.treehouse.systems 30 min. ago

oh this looks nasty

Package : apt
CVE ID : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root. — Package : apt CVE ID : CVE-2026-109518 Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.

1 Boost

0 Likes

d.rift

@d_rift@beige.party 11 min. ago

@whitequark This... only helps if there's a signature match on the result? Or?

Edit: oh, after verif... whaaaaat.

d.rift

@d_rift@beige.party 10 min. ago

@whitequark wait what in pickles is getting verified if it's verified before it's downloaded

This federated comment is not yet available here.

Sophie of Ratsnake Games

@ratsnakegames@mastodon.social 19 min. ago

@lizbian @whitequark yiiiiiikes. In 2026? Really?

✧✦Catherine✦✧

@whitequark@social.treehouse.systems 18 min. ago

@ratsnakegames @lizbian when serving static content it's easy to get in a situation where TLS is your bottleneck so I don't think this is outrageous, but yeah it's not great in this particular instance

Sophie of Ratsnake Games

@ratsnakegames@mastodon.social 16 min. ago

@whitequark @lizbian i mean, i get that the certificate system built into apt is supposed to protect against MITM so HTTPS isn't strictly speaking necessary for that purpose, but after Snowden i'd have expected HTTPS to be enabled for privacy alone

1 more reply

Sophie of Ratsnake Games

@ratsnakegames@mastodon.social 26 min. ago

@whitequark does apt use HTTP per default rather than HTTPS? I reckon HTTPS would largely mitigate this

d.rift

@d_rift@beige.party 13 min. ago

@ratsnakegames @whitequark 4 ?

Sophie of Ratsnake Games

@ratsnakegames@mastodon.social 12 min. ago

@d_rift @whitequark i did do an update in the several weeks since that dropped and i suspect so has every other responsible sysadmin