On 11/8/26 7:22 PM, Andrew M.A. Cater wrote: > On Sun, Nov 08, 2026 at 06:50:14PM +0300, monodev wrote: >> >> If my understanding is correct all new Debian installs from November 4 >> to November 21, and any installs using outdated images after November >> 21, will be trivially vulnerable to MITM attacks. >> > > I think your understanding may be incorrect here. If you boot using > a current 13.7 netinst image and use the standard mirrors / the deb.debian.org > stanzas, then the new apt will be installed as part of the initial > bootstrapping. By the time you've got a user added and reboot - you've > got the new apt. > > That goes for every install, obviously. The fixes were published on > November 4th. > > If you don't connect your machine to a network *at all* and use a DVD or > larger image to install all of your software on the machine - that might > be vulnerable if it is from current media but that is a minor use case. > If you don't connect your machine to a network and maintain it as > air-gapped, then you'll presumably just update it from media periodically. > Thanks for the quick response!
I had assumed that the initial bootstrapping process would be equivalent to a post-install upgrade via apt and thus would be similarly vulnerable. Glad to know that isn't the case. - monodev
