APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
{ "urgency": "not yet assigned" }
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-0487.json"