5 ms·
HTTP redirect vulnerability in apt package manager
- est31 8y agoWeren't PGP signatures supposed to ensure integrity? How is this being bypassed?
- detaro 8y agoThe attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html
- jwilk 8y agoDiscussed on HN: https://news.ycombinator.com/item?id=18968370 https://news.ycombinator.com/item?id=18968370
- jwilk 8y agoPlease use the original title.
- mondoshawan 8y agoIronic, given the previous discussion on why apt shouldn't use HTTPS connections. With full end-to-end SSL validation, this kind of vulnerability can't exist. Should be interesting to see how the community reacta to this.