I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.<p>[0] <a href="https://x.com/just1cz/status/2118009777922228361" rel="nofollow">https://x.com/just1cz/status/2118009777922228361</a>
<a href="https://xnotme.com/just1cz/status/2118009777922228361" rel="nofollow">https://xnotme.com/just1cz/status/2118009777922228361</a>
Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:<p><pre><code> apt -o Acquire::http::AllowRedirect=false update
apt -o Acquire::http::AllowRedirect=false upgrade
</code></pre>
Since this also involves redirects, would that protect users while updating apt for this one also?
Speaking of which… if any of y’all work on security at OpenAI I have some questions for you about Daybreak! Please email me
But how do I update apt if apt is untrustable until fixed ? Good ol' .deb scp'd in dpkg'd.
dupe (2h ago): <a href="https://news.ycombinator.com/item?id=50364814">https://news.ycombinator.com/item?id=50364814</a>
How would an attacker inject a redirect into an apt package download?
I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.<p>edit: On lobste.rs I see a recommendation for `apt download`: <a href="https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_execution" rel="nofollow">https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...</a>
Discussion here: <a href="https://news.ycombinator.com/item?id=50364814">https://news.ycombinator.com/item?id=50364814</a>
[flagged]
[dead]
[flagged]