8 ms·
Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?
by est31 8y ago
Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?
- detaro 8y agoThe attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html
- jwilk 8y agoDiscussed on HN: https://news.ycombinator.com/item?id=18968370 https://news.ycombinator.com/item?id=18968370