Debian apt 安全更新（中间人攻击）

Debian apt 安全更新（中间人攻击）
Debian apt security update (man-in-the-middle)

原始链接: https://lists.debian.org/debian-security-announce/2026/msg00526.html?pow_referer=

Debian 安全公告 DSA-6607-1（2026 年 11 月 4 日）报告了 apt 中的 CVE-2026-109518 漏洞，由 Max Justicz 发现。中间人攻击者可利用重定向后的 HTTP 下载续传/文件处理不当，替换已验证的软件包，导致以 root 权限执行任意代码。Debian stable（trixie）在 apt 3.0.4 中已修复；该更新还解决了越界访问问题。用户应升级 apt 软件包。

一篇 Hacker News 讨论涉及由研究员 justicz 发现的 Debian apt 中间人漏洞（该研究员也曾发现过类似 2019 年漏洞）。该漏洞涉及恢复 HTTP 下载时的不当文件处理：并行下载和硬链接可让攻击者在包的哈希校验之后交换包。APT 维护者和 Ubuntu 推荐的缓解措施是 `apt -o Acquire::Retries=0 upgrade`（或 update），因为某些镜像使用重定向；`Acquire::http::AllowRedirect=false` 也可能有帮助。用户也可以选择手动 scp `.deb` 文件并用 dpkg 安装。评论者指出 apt-cacher-ultra 可降低暴露风险，并就 apt 使用 HTTPS 展开讨论——HTTPS 会有帮助，但镜像并未完全可信，因此签名仍然必不可少。发现者认为，安全关键的复杂软件应被重写并形式化验证，并且现代 AI 工具使审计暴露于互联网的代码变得必不可少。该讨论还涉及 AI 红队测试、Project Glasswing，以及如何验证系统尚未被入侵。

原文

[SECURITY] [DSA 6607-1] apt security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6607-1                   [email protected]
https://www.debian.org/security/                     Salvatore Bonaccorso
November 04, 2026                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : apt
CVE ID         : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.

For the detailed security status of apt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apt

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh
8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+
lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA
9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD
YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk
OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8
iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo
+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf
n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf
vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm
ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=
=VlLy
-----END PGP SIGNATURE-----

Reply to:

Debian apt 安全更新（中间人攻击） Debian apt security update (man-in-the-middle)

Debian apt 安全更新（中间人攻击）
Debian apt security update (man-in-the-middle)