The officially official Devuan Forum!

jue-gen

Member

Registered: 2022-07-07

Posts: 132  

Security vulnerability in APT allows execution of malicious code

I’m not entirely confident in my English, so I have a question: Has a security update arrived in Devuan? How can I check this?

Package        : apt
CVE ID         : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.

https://lists.debian.org/debian-securit … news.de%2F

tux_99

Member

Registered: 2025-06-17

Posts: 207  

Re: Security vulnerability in APT allows execution of malicious code

Has a security update arrived in Devuan?
For the stable distribution (trixie), this problem has been fixed in version 3.0.4.

Seems not:

$ apt list apt
apt/stable,now 3.0.3devuan1 amd64 [installed]
apt/stable 3.0.3devuan1 i386

Last edited by tux_99 (Today 13:16:06)

---

“Either the users control the program – or the program controls the users” Richard Stallman

fsmithred

Administrator

Registered: 2016-11-25

Posts: 3,016  

Re: Security vulnerability in APT allows execution of malicious code

It's in excalibur-proposed-updates.

$ apt policy apt
apt:
  Installed: 3.0.4devuan1
  Candidate: 3.0.4devuan1
  Version table:
 *** 3.0.4devuan1 500
        500 http://pkgmaster.devuan.org/merged excalibur-proposed-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.3devuan1 500
        500 http://sledjhamr.org/devuan/merged excalibur/main amd64 Packages

jue-gen

Member

Registered: 2022-07-07

Posts: 132  

Re: Security vulnerability in APT allows execution of malicious code

Thank you! I "Enabled: yes" for excalibur-proposed-updates. Now it’s okay, too.:

apt:
  Installiert:           3.0.4devuan1
  Installationskandidat: 3.0.4devuan1
  Versionstabelle:
 *** 3.0.4devuan1 500
        500 http://deb.devuan.org/merged excalibur-proposed-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.3devuan1 500
        500 http://deb.devuan.org/merged excalibur/main amd64 Packages