Debian apt security update (man-in-the-middle)

8organicbits

I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades. edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...

thewisenerd

dupe (2h ago): https://news.ycombinator.com/item?id=50364814

justicz

I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools. [0] https://x.com/just1cz/status/2118009777922228361

SoftTalker

How would an attacker inject a redirect into an apt package download?

hollow-moe

But how do I update apt if apt is untrustable until fixed ? Good ol' .deb scp'd in dpkg'd.

ChrisArchitect

Discussion here: https://news.ycombinator.com/item?id=50364814

linsomniac

For those of you not familiar, apt-cacher-ultra is fairly new (~9 months old), and it can reduce your exposure to this. It uses a completely different mechanism for verifying signatures, and does validate signatures, so if your apt clients grab the packages from the cache, it shouldn't be open to this bug. The next version is going to include TLS and ACME support for the client->cache connection. https://github.com/linsomniac/apt-cacher-ultra

xeyownt

We are living in times where I read first in HN what apticron is going to send me by mail.

getcrunk

It always bothered me that apt didn’t use encryption, I know the issue here doesn’t boils down to that, but damn this sucks. Sure I can update, but how to check I want compromised? Will apt check the state of past/installed updates?