News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in apt/apt-get. Parent comment

Re:Remote code execution vulnerability in apt/apt-get by detaro on Tuesday January 22, 2019 @11:58AM (#18969753)
Both. Without HTTPS, you can execute the attack if you can MITM the connection to the package repository. If HTTPS is used, you need to be the package repository to do the attack, or need a certificate to MITM the connection so you can pretend to be it.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by gnulinux on Tuesday January 22, 2019 @04:26PM (#18972655)
With HTTPS a MitM attacker can still refuse to serve a specific package.
[ Parent | on HN ]