alt Hacker NewsIt's not 'Attack Vector: Network' in cvss, so it's probably scoring lower than a 7.
EDIT: With 'AV:Adjacent Network' and A 'User Interaction: Required' and max impact (High on Confidentiality, Integrity and Availability, assuming worst case), then it gets a score of 8.
The subjectives lower the severity to my eyes as well, including the use of HTTP mirrors (which is the default notwithstanding), and the attacker needing to be an existing mirror at the time of the announcement, which is already a vetted group (or be in the path between the user and the mirrors, umm that is quite possible though, but quite hard to target). And finally the window for the disclosure and attacks is almost null, someone needs to use apt to be vulnerable, but if they use apt, they are probably autoupdating apt itself, I wonder if a simple 'apt install thing' will trigger an apt upgrade, in order to patch those that are not running autoupgrades.
Nitpick about CVSS scoring:
I always strongly argue against framing MITM scenarios as AV:Adjacent as MITM attacks can be performed at any point of the transmission path. If someone MITMs the package mirror the attacker is certainly not adjacent to the vulnerable component. I argue in favor of using Attack Complexity: High instead, as you do need to be in a MITM position.
And while UI:Required could be argued, there are also unattended upgrades and updates are performed regularly anyway. CVSS 4 makes some progress here with UI active vs passive, but ultimately CVSS is often not helpful for capturing the unique risk of a vulnerability.