CVE-2019-3462: Debian GNU/Linux apt as used in Debian Stretch and Ubuntu vulnerability
Debian GNU/Linux · apt as used in Debian Stretch and Ubuntu
Fixed in Debian 12/13 · Affected: Debian GNU/Linux apt as used in Debian Stretch and Ubuntu · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub24 Jan 2019
- Not established: not seen
Higher than 96% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Debian 13Fixedchecked 5 Nov 12:30 UTC
- Debian 12Fixedchecked 5 Nov 12:30 UTC
What changed
Debian status tracked since 5 Nov 2026.
- Seen in Debian’s tracker on 5 Nov: Debian 12 fixed Debian
- Seen in Debian’s tracker on 5 Nov: Debian 13 fixed Debian
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
CoverageNo articles yet
No CyberSIXT article names CVE-2019-3462 yet. New articles appear here and in the RSS feed.