Retry settings determine who’s uncovered
The vulnerability is dependent upon APT’s Purchase::Retries setting being non-zero. APT builders say this has been the default since model 2.3.2, though scripts could have enabled retries on older installations. Ubuntu specifies that the default retry worth of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases should not uncovered by default, however should be weak if retries have been enabled.
Debian 13 (Trixie) is patched in APT 3.0.4, whereas Debian 12 (Bookworm) acquired the repair in model 2.6.2. Ubuntu has additionally launched patched packages for supported releases, together with 22.04 LTS, 24.04.LTS, and 26.04 LTS. Ubuntu 26.10 was additionally affected, with its repair being printed when Ubuntu’s November 4 advisory appeared. The repair addresses the underlying file-handling problem. In a commit authored on October 12, APT developer Julian Andres Klode modified the obtain code to open vacation spot recordsdata completely, unlinking present recordsdata earlier than copying over any partially downloaded content material.
The change prevents downloads from writing by means of present exhausting hyperlinks, which may in any other case redirect writes to unintended recordsdata.
