Threats tagged 'ghsa-jw32-37xr-xwfw'

A vulnerability in Debian, Ubuntu, and derivative Linux distributions allows an on-path attacker who can manipulate HTTP traffic between an APT client and archive server to trick the client into installing an attacker-controlled unverified package. This can lead to remote code execution with root privileges. The issue arises from the reuse of hard links and requires the client to follow redirects and retry downloads, which depends on a non-zero Acquire::Retries setting. The default setting enabling this behavior is present starting with Debian 12 and Ubuntu 22.04 LTS, making older releases unaffected by default.