Remote code execution vulnerability in apt/apt-get
1–10 of 166 posts
Re: Remote code execution vulnerability in apt/apt-get
#2[deleted]
Re: Remote code execution vulnerability in apt/apt-get
#3> Thank you to the apt maintainers for patching this vulnerability quickly, and to the Debian security team for coordinating the disclosure. This bug has been assigned CVE-2019-3462.
From the article. Good stuff
Re: Remote code execution vulnerability in apt/apt-get
#4> a malicious mirror could still exploit a bug like this, even with https. But I suspect that a network adversary serving an exploit is far more likely than deb.debian.org serving one or their TLS certificate getting compromised
Exactly, this is far more easily exploitable because apt is using HTTP by default instead of HTTPS
Re: Remote code execution vulnerability in apt/apt-get
#5Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.
Re: Remote code execution vulnerability in apt/apt-get
#6Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.
He never explains why he wants to use HTTP, it’s only about why he thinks HTTPS isn’t nesscary.
Re: Remote code execution vulnerability in apt/apt-get
#7Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.
OTOH, they would have been right if there had been (yet another) bug in openssl/whatever lib would be used for https.
FWIW: 16 vulns in apt in NVD [0]; but 202 for openssl [1]
[0] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
[1] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
Re: Remote code execution vulnerability in apt/apt-get
#8Seems like the discovery of this vuln was a direct result of yesterday's discussion about HTTPS on apt here on HN (https://news.ycombinator.com/item?id=18958679).
Re: Remote code execution vulnerability in apt/apt-get
#9Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.
Discussed yesterday:
Re: Remote code execution vulnerability in apt/apt-get
#10Seems like the discovery of this vuln was a direct result of yesterday's discussion about HTTPS on apt here on HN ( https://news.ycombinator.com/item?id=18958679 ).
Nope, I reported this bug several days ago. Funny coincidence though.