I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.

[0] https://x.com/just1cz/status/2118009777922228361

For those of you not familiar, apt-cacher-ultra is fairly new (~9 months old), and it can reduce your exposure to this. It uses a completely different mechanism for verifying signatures, and does validate signatures, so if your apt clients grab the packages from the cache, it shouldn't be open to this bug.

The next version is going to include TLS and ACME support for the client->cache connection.

https://github.com/linsomniac/apt-cacher-ultra

But how do I update apt if apt is untrustable until fixed ? Good ol' .deb scp'd in dpkg'd.

dupe (2h ago): https://news.ycombinator.com/item?id=50364814

I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.

edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...

How would an attacker inject a redirect into an apt package download?

Discussion here: https://news.ycombinator.com/item?id=50364814

[flagged]

[dead]

[flagged]