No word as of yet if Ubuntu's apt is also impacted.
Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.
It almost seems like a repeat of two previous apt vulnerabilities:
Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?
Debian is such a clown show. The SSL fiasco, apt over http, overpatching packages, allowing AI, kicking out packages over some lintian bullshit.
How are you going to update if apt is compromised?
No word as of yet if Ubuntu's apt is also impacted.
Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.
It almost seems like a repeat of two previous apt vulnerabilities:
In 2019: https://lists.debian.org/debian-security-announce/2019/msg00...
And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...
I thought there might be some kind of hash or signature, but I’m assuming that can be forged along with the main payload?
From the short description in the advisory, would seem like the attacker can cause the tool to overwrite the file after signature verification.
> We recommend that you upgrade your apt packages.
Is there a German word for a broken tool that can only be fixed by using the same broken tool?
Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?