https://lists.debian.org/debian-security-announce/2026/msg00526.html
https://lists.debian.org/deity/2026/11/msg00005.html
In short, this APT exploit allows an attacker to replace a package after verification, resulting in arbitrary code execution as root.
Besides updating apt to version 3.0.4+ (
If not already done so, you should immediately upgrade
Non-subscribing Proxmox users are highly affected by this vulnerability, since HTTP connection of non-enterprise Proxmox package repository allows a Man-In-The-Middle attack, tampering with transferred package and replacing it by arbitrary package as superuser.
Kindly asking: In order to prevent similar future vulnerabilities and enhance base security for all Proxmox users, would it be possible to also switch to secure HTTPS connection for non-enterprise repo?
Kind regards
https://lists.debian.org/deity/2026/11/msg00005.html
In short, this APT exploit allows an attacker to replace a package after verification, resulting in arbitrary code execution as root.
Besides updating apt to version 3.0.4+ (
apt --version), an effective protection mechanism is to provide software repositories via HTTPS connection.If not already done so, you should immediately upgrade
apt before triggering any Proxmox updates from the unencrypted HTTP repository:
Code:
sudo apt-get update && sudo apt-get install --only-upgrade -o Acquire::Retries=0 aptNon-subscribing Proxmox users are highly affected by this vulnerability, since HTTP connection of non-enterprise Proxmox package repository allows a Man-In-The-Middle attack, tampering with transferred package and replacing it by arbitrary package as superuser.
Kindly asking: In order to prevent similar future vulnerabilities and enhance base security for all Proxmox users, would it be possible to also switch to secure HTTPS connection for non-enterprise repo?
Kind regards
Last edited: