The vulnerability exists in the HTTP backend invoked by the APT library, and affects any APT-based frontend (apt, apt-get, aptitude, or any of the Ubuntu graphical applications).

The use of TLS via HTTPS protects against this vulnerability, as exploitation requires the attacker to manipulate HTTP traffic.

What a fucking surprise. They've been trying to justify using HTTP for apt repositories with the excuse "but every package is signed by GPG." Well guess what, fuckers! WE FUCKING TOLD YOU SO!