Advisoriesby IbisAPT package manager that affects Ubuntu and Debian operating systems
Bulletin ID: 2026-172-AWS Publication Date: 11/05/2026 20:00 PM PST Description: An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1). The following fixed versions address this issue: - Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1 - Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1 - Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1 - Debian (DSA-6607-1): See Debian Security Advisory for version details Customers running Ubuntu or Debian-based Amazon EC2 instances or container images should apply the updates. For details, see the full AWS Security Bulletin. Read this article
Affected versions
Changes since it was listed
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- NVD
More AWS advisories
All AWS
Issues with Babelfish for Aurora PostgreSQLCVE-2026-119923no fix yetIssue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM...CVE-2026-122193no fix yetGluonTS arbitrary file write during archive extractionCVE-2026-119083no fix yetImproper isolation of shared resources in aws-network-policy-agent in Amazon EKSCVE-2026-122266no fix yetGuest Access to Firecracker Process Memory After a Failed Memory DiscardCVE-2026-122192no fix yetAWS API MCP Server OAuth token audience validation bypassCVE-2026-115413no fix yet