The officially official Devuan Forum!

jue-gen

Member

Registered: 2022-07-07

Posts: 134  

Security vulnerability in APT allows execution of malicious code

I’m not entirely confident in my English, so I have a question: Has a security update arrived in Devuan? How can I check this?

Package        : apt
CVE ID         : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.

https://lists.debian.org/debian-securit … news.de%2F

tux_99

Member

Registered: 2025-06-17

Posts: 210  

Re: Security vulnerability in APT allows execution of malicious code

Has a security update arrived in Devuan?
For the stable distribution (trixie), this problem has been fixed in version 3.0.4.

Seems not:

$ apt list apt
apt/stable,now 3.0.3devuan1 amd64 [installed]
apt/stable 3.0.3devuan1 i386

Last edited by tux_99 (Yesterday 13:16:06)

---

“Either the users control the program – or the program controls the users” Richard Stallman

fsmithred

Administrator

Registered: 2016-11-25

Posts: 3,016  

Re: Security vulnerability in APT allows execution of malicious code

It's in excalibur-proposed-updates.

$ apt policy apt
apt:
  Installed: 3.0.4devuan1
  Candidate: 3.0.4devuan1
  Version table:
 *** 3.0.4devuan1 500
        500 http://pkgmaster.devuan.org/merged excalibur-proposed-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.3devuan1 500
        500 http://sledjhamr.org/devuan/merged excalibur/main amd64 Packages

jue-gen

Member

Registered: 2022-07-07

Posts: 134  

Re: Security vulnerability in APT allows execution of malicious code

Thank you! I "Enabled: yes" for excalibur-proposed-updates. Now it’s okay, too.:

apt:
  Installiert:           3.0.4devuan1
  Installationskandidat: 3.0.4devuan1
  Versionstabelle:
 *** 3.0.4devuan1 500
        500 http://deb.devuan.org/merged excalibur-proposed-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.3devuan1 500
        500 http://deb.devuan.org/merged excalibur/main amd64 Packages

tux_99

Member

Registered: 2025-06-17

Posts: 210  

Re: Security vulnerability in APT allows execution of malicious code

It's in excalibur-proposed-updates.

I assume that means it will soon be moved to stable-security or stable-updates or do I have to enable proposed-updates to get it at all?

---

“Either the users control the program – or the program controls the users” Richard Stallman

jue-gen

Member

Registered: 2022-07-07

Posts: 134  

Re: Security vulnerability in APT allows execution of malicious code

I don’t know either; I’ve enabled ‘proposed-updates’, so everything will come through in the future.

kapqa

Member

Registered: 2019-01-02

Posts: 817  

Re: Security vulnerability in APT allows execution of malicious code

wonder what to think of if ubuntu reports "apt 3.2.0 (arm64)" since today there was video in the feed that said something of ubuntu-server npt having patched such athing CVS or similar for quite some now.

tux_99

Member

Registered: 2025-06-17

Posts: 210  

Re: Security vulnerability in APT allows execution of malicious code

Ok, I see the updated apt package has been moved to stable-security now so no need to enable proposed-updates:

$ apt list apt
apt/stable-security 3.0.4devuan1 amd64 [upgradable from: 3.0.3devuan1]
apt/stable-security 3.0.4devuan1 i386

---

“Either the users control the program – or the program controls the users” Richard Stallman

jue-gen

Member

Registered: 2022-07-07

Posts: 134  

Re: Security vulnerability in APT allows execution of malicious code

It is interesting that the security updates first appeared in "proposed-updates" and only subsequently in "stable-security".

bai4Iej2need

Member

From: Ortenau

Registered: 2021-04-25

Posts: 168  

Re: Security vulnerability in APT allows execution of malicious code

how about is daedalus affected or patched ?

Last edited by bai4Iej2need (Today 08:46:03)

---

The devil, you know, is better than the angel, you don't know. by a British Citizen, I don't know too good.
One generation abandons the enterprises of another like stranded vessels. By Henry David Thoreau, WALDEN, Economy. Line 236 (Gutenberg text Version)
broken by design :
https://bugs.debian.org/cgi-bin/bugrepo … bug=958390

Altoid

Member

Registered: 2017-05-07

Posts: 2,136  

Re: Security vulnerability in APT allows execution of malicious code

Hello:

... daedalus affected or patched?

Easiest is using [synaptic] and some command line:

1. open up [synaptic]
2. hit the [reload] button
3. go to [settings] -> [repositories]
4. look for the check-box for [http:/deb/devuan.org/merged daedalus-proposed-updates]   
5. check the box and hit reload again
6. exit [synaptic]

Now you have enabled [http:/deb/devuan.org/merged daedalus-proposed-updates].

7. open a terminal
8. become [root] and do:

# apt install apt

Once done, exit [root] and check the installed version:

$ apt -v
apt 2.6.2devuan1 (amd64)   ### this is the upgraded version for [daedalus].
~$ 

Next, disable [http:/deb/devuan.org/merged daedalus-proposed-updates] which is not usually needed/desired.

Redo steps 1-6, this time unchecking the box for [http:/deb/devuan.org/merged daedalus-proposed-updates], hitting the reload button and exiting [synaptic].   

Best,

A.

Last edited by Altoid (Today 10:11:35)