[detaro]

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

[jwilk]

Discussed on HN:

https://news.ycombinator.com/item?id=18968370