Debian apt security update: man-in-the-middle arbitrary code execution

Not surprised at all. I remember all of the heated discussions (even here on HN) around there being absolutely no need for HTTPS because "everything is signed with PGP".

Hopefully this example settles at least some of this pointless discussion.

Bonus, the man in the middle can see what packages you’re downloading since you’re not using HTTPS, so they know if you’re vulnerable during an update.

I never understood the insistence on using HTTP as a default for apt. Once HTTPS transport was available and tested (which took forever btw) then it should have become the default. Maybe this will spur some changes.

No word as of yet if Ubuntu's apt is also impacted.

Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it.

It almost seems like a repeat of two previous apt vulnerabilities:

In 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...

It's always been strange to me and I've been saying forever that I don't get why package repos don't use HTTPS.

> We recommend that you upgrade your apt packages.

Is there a German word for a broken tool that can only be fixed by using the same broken tool?

If I understand correctly, trixie-security contains a fixed version, however, bookworm not (yet)?

Is it going to be fixed for oldstable?

Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?

If necessary, with instructions for downloading and verifying it out of band

Or maybe by passing a parameter to the old apt that disables the vulnerable HTTP download resumption when downloading the new apt

Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?

interesting, why is verification not running after package is already on hard drive in full ?

yey, my computers and containers aren't vulnerable (^-^)

Debian is such a clown show. The SSL fiasco, apt over http, overpatching packages, allowing AI, kicking out packages over some lintian bullshit.

How are you going to update if apt is compromised?