HTTP redirect vulnerability in apt package manager

Posted by dansimau on Tuesday January 22, 2019 @08:54AM
from the lists.debian.org dept.

https://lists.debian.org/debian-security-announce/2019/msg00010.html

( 5 comments | 10 points | on HN )

Re:HTTP redirect vulnerability in apt package manager by mondoshawan on Tuesday January 22, 2019 @11:45AM (#18969585)

Ironic, given the previous discussion on why apt shouldn't use HTTPS connections. With full end-to-end SSL validation, this kind of vulnerability can't exist. Should be interesting to see how the community reacta to this.

[ Parent | on HN ]

Re:HTTP redirect vulnerability in apt package manager by est31 on Tuesday January 22, 2019 @09:08AM (#18968304)

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

[ Parent | on HN ]

Re:HTTP redirect vulnerability in apt package manager by detaro on Tuesday January 22, 2019 @09:12AM (#18968324)

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

[ Parent | on HN ]

Re:HTTP redirect vulnerability in apt package manager by jwilk on Tuesday January 22, 2019 @01:26PM (#18970808)

Discussed on HN:

https://news.ycombinator.com/item?id=18968370

[ Parent | on HN ]

Re:HTTP redirect vulnerability in apt package manager by jwilk on Tuesday January 22, 2019 @10:38AM (#18969002)

Please use the original title.

[ Parent | on HN ]