distronews.com stable7.2.15 mainline7.4-rc1
Qubes OS News

QSB-122: Package verification bypass in APT (DSA-6607-1)

qubes-os.org

Key points

The Qubes security team has issued QSB-122 over an APT flaw (Debian DSA 6607-1, CVE-2026-109518) that could let a malicious mirror or network attacker swap a package after APT has verified it, leading to root code execution in Debian and Whonix qubes. Qubes is shipping updated dom0 update tools for Qubes 4.3 so that APT itself gets updated safely.

The vulnerability

  • Debian published DSA 6607-1 on 2026-11-04; Max Justicz found the bug, which is also covered by the "APT-2026-11-01 security update" advisory.
  • After an HTTP redirect, APT can treat two different downloads as having the same URI and merge them. Faulty file handling when an HTTP download is resumed then lets an attacker replace a package after it has been checked.
  • This defeats APT's usual model of trusting signed repository metadata rather than the server or the transport.
  • An attack needs one of three conditions: control of the repository server (such as a third-party mirror), an unauthenticated transport like plain HTTP that the attacker can tamper with, or a separate flaw that grants either of those (for example a compromised certificate authority or certificate).

Who is affected

  • Systems with Debian or Whonix qubes are affected. Systems that use only Fedora or other non-APT qubes are not.
  • Debian and Whonix qubes use HTTPS repositories by default, which removes the man-in-the-middle path.
  • Users who switched any repository to plain HTTP are still exposed to that path.
  • Users who installed unofficial APT-based qubes are also affected.

Why a QSB was issued

  • Qubes normally does not publish bulletins for flaws confined to the inside of a qube.
  • This flaw can compromise templates, and every app qube and service qube built on a compromised template inherits the compromise. That includes Whonix and VPN proxy qubes, which matter for privacy.
  • Templates have no network access except through the update proxy, and this bug could undermine that protection.

Patched packages (Qubes 4.3, dom0)

  • qubes-core-dom0-linux 4.3.25
  • qubes-mgmt-salt-dom0-update 4.3.4
  • The packages are in security-testing now and will move to the current (stable) repository over the next two weeks after community testing.

What to do

  • If you use the Qubes Update tool, keep updating as usual. It applies updates in the correct order automatically.
  • If you update from the command line, first update dom0 alone with qubes-dom0-update in a dom0 terminal. Only after that succeeds, update all Debian and Whonix templates and standalones with qubes-vm-update, also from dom0.
  • Do not run apt directly inside any qube, because that bypasses the Qubes update protections.
  • Once dom0 and all Debian and Whonix templates and standalones are updated, restart all Debian and Whonix qubes.

Verifying the bulletin

  • The QSB is signed by Marek Marczykowski-Górecki and by Simon Gaiser (HW42).
  • To check it, import the Qubes Master Signing Key and confirm its fingerprint, 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494, against several independent sources before trusting it.
  • Inside gpg --edit-key, set the key's trust to 5 (ultimate) with trust, then quit with q.
  • Import the keys from qubes-secpack, check the signed Git tag, and verify both signatures. Each check should end in a line beginning "gpg: Good signature from".
gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
git clone https://github.com/QubesOS/qubes-secpack.git
gpg --import qubes-secpack/keys/*/*
cd qubes-secpack/
git tag -v `git describe`
cd QSBs/
gpg --verify qsb-122-2026.txt.sig.marmarek qsb-122-2026.txt
gpg --verify qsb-122-2026.txt.sig.simon qsb-122-2026.txt
  • Alternatively, paste the QSB text and both signatures from the announcement into local files and verify those instead.

Summary by DistroNews, based on the original post.

We have published Qubes Security Bulletin (QSB) 122: Package verification bypass in APT (DSA-6607-1). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 122 ---===[ Qubes Security Bulletin 122 ]===--- 2026-11-06 Package verification bypass in APT (DSA-6607-1) User action ------------ If you update Qubes OS using the Qubes Update tool, continue to update normally in order to receive the security updates described in the "Patching" section below. If you update Qubes OS using command-line tools instead of the Qubes Update tool, you must first update dom0 by itself (without any other qubes) via `qubes-dom0-update` in a dom0 terminal. Only after dom0 has been successfully updated should you update all Debian and Whonix templates and standalones via `qubes-vm-update` in a dom0 terminal. (The Qubes Update tool automatically handles updating in the correct order.) Do not attempt to update any qube using the `apt` command directly, as this bypasses built-in Qubes OS update security measures. Use only the Qubes Update tool or its command-line equivalents in the order described above. [1] After updating dom0 and all Debian and Whonix templates and standalones, we recommend restarting all Debian and Whonix qubes to ensure the updates take effect. Summary -------- On 2026-11-04, the Debian security team published DSA 6607-1, "apt security update" (CVE-2026-109518) [3]: | Max Justicz discovered a vulnerability in the APT package manager. APT | can merge two different package downloads after an HTTP redirect gives | them the same URI. Improper file handling when resuming an HTTP | download allows a man-in-the-middle attacker to replace a package | after verification, resulting in the execution of arbitrary code as | root. Also see "APT-2026-11-01 security update."

This is the opening of the story. The full text is on the original page.

Read the original at qubes-os.org