For what it's worth there is an apt "Acquire::http::AllowRedirect" option that can be disabled.
Is this the right way to specify it when upgrading the vulnerable apt?
# apt -o 'Acquire::http::AllowRedirect=false' update
# apt -o 'Acquire::http::AllowRedirect=false' install apt
> For what it's worth there is an apt "Acquire::http::AllowRedirect"
Odd, I am not familiar with that that German word.