APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "1.0.1ubuntu2.3", "binary_name": "apt" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "apt-doc" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "apt-transport-https" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "apt-utils" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "libapt-inst1.5" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "libapt-pkg-dev" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "libapt-pkg-doc" }, { "binary_version": "1.0.1ubuntu2.3", "binary_name": "libapt-pkg4.12" } ] }