4 ms·
So how do I safely update apt to the patched version on Debian Jessie? It's apparently fixed in version 1.0.9.8.5: https://security-tracker.debian.org/tracker/
by ptx 8y ago
So how do I safely update apt to the patched version on Debian Jessie?
It's apparently fixed in version 1.0.9.8.5: https://security-tracker.debian.org/tracker/CVE-2019-3462 https://security-tracker.debian.org/tracker/CVE-2019-3462
...but the suggested apt -o Acquire::http::AllowRedirect=false update fails because security.debian.org wants to do a redirect.
Manually downloading the packages listed in the announcement doesn't work either, since that's the Stretch version.
I can get the source package here: https://packages.debian.org/jessie/apt https://packages.debian.org/jessie/apt
...but the key is not in /usr/share/keyrings/debian-archive-keyring.gpg. (And I'm not entirely sure how to build a source package.)
I tried adding a different source, as suggested in the announcement:
deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main
...but it seems it can't find the right versions of all the dependencies:
# apt -o Acquire::http::AllowRedirect=false install apt apt-utils libapt-pkg5.0 libapt-inst2.0 liblz4-1
...
The following packages have unmet dependencies:
libapt-pkg5.0 : Depends: liblz4-1 (>= 0.0~r127) but 0.0~r122-2 is to be installed
E: Unable to correct problems, you have held broken packages.
- jwilk 8y agoNo idea why would would security.debian.org make a redirect. Can you paste the whole error message? Regarding the other error, jessie ≠ stable. You want "jessie/updates", not "stable/updates".
- ptx 8y agoAh, silly blind copy-pasting on my part. With "jessie/updates" it works. Thanks! The message I was referring to, which looks like it's indicating that security.debian.org is trying to redirect: # apt -o Acquire::http::AllowRedirect=false update ... Err http://security.debian.org jessie/updates/main Sources 302 Found [IP: 217.196.149.233 80] Err http://security.debian.org jessie/updates/main amd64 Packages 302 Found [IP: 217.196.149.233 80] Err http://security.debian.org jessie/updates/non-free amd64 Packages 302 Found [IP: 217.196.149.233 80] Err http://security.debian.org jessie/updates/main i386 Packages 302 Found [IP: 217.196.149.233 80] Err http://security.debian.org jessie/updates/non-free i386 Packages 302 Found [IP: 217.196.149.233 80] Fetched 422 kB in 2s (169 kB/s) W: Failed to fetch http://security.debian.org/dists/jessie/updates/main/source/Sources 302 Found [IP: 217.196.149.233 80] W: Failed to fetch http://security.debian.org/dists/jessie/updates/main/binary-amd64/Packages 302 Found [IP: 217.196.149.233 80] W: Failed to fetch http://security.debian.org/dists/jessie/updates/non-free/binary-amd64/Packages 302 Found [IP: 217.196.149.233 80] W: Failed to fetch http://security.debian.org/dists/jessie/updates/main/binary-i386/Packages 302 Found [IP: 217.196.149.233 80] W: Failed to fetch http://security.debian.org/dists/jessie/updates/non-free/binary-i386/Packages 302 Found [IP: 217.196.149.233 80] E: Some index files failed to download. They have been ignored, or old ones used instead.