Remote code execution vulnerability in apt/apt-get

So how do I safely update apt to the patched version on Debian Jessie?

It's apparently fixed in version 1.0.9.8.5: https://security-tracker.debian.org/tracker/CVE-2019-3462

...but the suggested apt -o Acquire::http::AllowRedirect=false update fails because security.debian.org wants to do a redirect.

Manually downloading the packages listed in the announcement doesn't work either, since that's the Stretch version.

I can get the source package here: https://packages.debian.org/jessie/apt

...but the key is not in /usr/share/keyrings/debian-archive-keyring.gpg. (And I'm not entirely sure how to build a source package.)

I tried adding a different source, as suggested in the announcement:

  deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main

...but it seems it can't find the right versions of all the dependencies:

  # apt -o Acquire::http::AllowRedirect=false install apt apt-utils libapt-pkg5.0 libapt-inst2.0 liblz4-1
  ...
  The following packages have unmet dependencies:
   libapt-pkg5.0 : Depends: liblz4-1 (>= 0.0~r127) but 0.0~r122-2 is to be installed
  E: Unable to correct problems, you have held broken packages.

No idea why would would security.debian.org make a redirect. Can you paste the whole error message?

Regarding the other error, jessie ≠ stable. You want "jessie/updates", not "stable/updates".

I guess some people disagree?

But if any response in the redirect chain is served over HTTP, it can be replaced with a different response containing any "Location" header of the attacker's choosing instead of the original one. So it doesn't matter if the eventual intended URL is an HTTPS URL, because it will never be reached. The redirect will go to the attacker's site instead. (And in the case of a download, the user will never notice because the file URL is usually not prominently displayed.)

So a HTTP response anywhere in a redirect chain is equivalent to serving it over HTTP. Perhaps this was exactly the point of the parent post, but I thought it would be useful to make it explicit.