Hacker News

points by sczi 4 days ago | 0 comments

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade

Since this also involves redirects, would that protect users while updating apt for this one also?

[–] justicz 4 days ago

That sounds right to me, but FYI the APT maintainers themselves are recommending Acquire::Retries=0 as the mitigation since some mirrors might actually have redirects.

[–] winny314 3 days ago

I saw the ubuntu announcement also defers to the `apt upgrade -o Acquire::Retries=0` recommendation

https://ubuntu.com/blog/apt-vulnerability-fixes-available