Debian 9.7 Released To Address APT Security Issue

[dungeon]

That's just for stable though. Does the issue affect testing and unstable as well?

Affected were any currently supported Debian 7, 8, 9 and 10. So users of stable, testing, unstable, lts, elts... they all recieved update for this.

It is just that current release take a note (and here updated installer too) as that is most in use, so hot spot On existing installations Debian 9 users get this update week ago really, so here news is just updated installer too

[carewolf]

That's just for stable though. Does the issue affect testing and unstable as well?

[linner]

Anyone understand how an attack like this works? So what if content is injected in to the HTTP stream. That's ALWAYS a possibility regardless of redirection bugs. Isn't the deb package verified after download?

Edit:
Never mind. I found the original source of the bug. I understand how it works now. Wow... that's nasty. I wonder how long this has been used to hack machines running updates over proxies (eg. things like Tor).

https://justi.cz/security/2019/01/22/apt-rce.html

[Mark Rose]

They should use TLS for the connections too and use dane on the package server domains as additional protectiob

TLS is problematic when using a proxy to cache package downloads.

[UlisesH]

They should use TLS for the connections too and use dane on the package server domains as additional protectiob

My understanding is that APT allows to download from HTTP, but that's all right cause they check the signature of the packages. This avoids the penalty associated with HTTPS.

[bemerk]

They should use TLS for the connections too and use dane on the package server domains as additional protectiob

[phoronix]

Phoronix: Debian 9.7 Released To Address APT Security Issue

Debian 9.7 is out today as an emergency release for the project...

http://www.phoronix.com/scan.php?page=news_item&px=Debian-9.7-Released