https://lists.debian.org/debian-security-announce/2019/msg00010.html
Stumbled on this, and checked my vero’s, both had 1.4.8 installed, one I tried from the osmc update app, no updates available, ssh in and sudo apt update, sudo apt install apt, now version 1.4.9, the patched version