Debian apt security update: man-in-the-middle arbitrary code execution

Re:Debian apt security update: man-in-the-middle arbitrary c... by greggsy on Wednesday November 04, 2026 @08:05AM (#50365002)

> We recommend that you upgrade your apt packages.

Is there a German word for a broken tool that can only be fixed by using the same broken tool?

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by pllbnk on Wednesday November 04, 2026 @08:14AM (#50365098)

Münchhausenwerkzeug.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by ahofmann on Wednesday November 04, 2026 @08:17AM (#50365133)

Well, of course there is "Selbstreparaturparadoxon", but nobody uses that. This is more like a Münchhausen-Problem, where Baron Münchhausen pulls himself out of the swamp by his own hair.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by veeti on Wednesday November 04, 2026 @08:28AM (#50365247)

For what it's worth there is an apt "Acquire::http::AllowRedirect" option that can be disabled.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by hackyhacky on Wednesday November 04, 2026 @09:10AM (#50365769)

> For what it's worth there is an apt "Acquire::http::AllowRedirect"

Odd, I am not familiar with that that German word.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by ptx on Wednesday November 04, 2026 @09:43AM (#50366213)

Is this the right way to specify it when upgrading the vulnerable apt?

  # apt -o 'Acquire::http::AllowRedirect=false' update
  # apt -o 'Acquire::http::AllowRedirect=false' install apt

[ Parent | on HN ]