On 10/11/2026 1:24 am, Andrew M.A. Cater wrote:
On Tue, Nov 10, 2026 at 12:40:07AM +0700, Max Nikulin wrote:
Isn't getting updates the moment when the new system may be compromised if
an attacker may act as a MITM (unless the user adjusts APT configuration)?
Assume an attacker can put in a MITM - for example, bypassing deb.debian.org
(compromising all of Cloudflare, for example).
I am not trying to say that every install is affected. However it may be
extremely painful experience (e.g. a hidden rootkit to steal
credentials) for a small fraction of users who are unlucky to connect to
malicious hotspots or due to attacks on their ISP or hosting providers.
That attacker also has to regenerate all GPG signatures on the archive,
and sign hashes and sizes accordingly.
It is not my reading of
<https://security-tracker.debian.org/tracker/CVE-2026-109518>.
I have not tried it in action, but my impression is that it is enough to
intercept some HTTP requests. A downloaded deb package with correct
checksum may be replaced with a dangerous one before install step.
Dodgy packages, non-matching signatures / mismatches in hashes and file
sizes are all flagged up when apt installs packages - as you'll find out
if there's an interruption in rsync or whatever.
I am aware that apt is designed to work in untrusted environment.
Unfortunately bugs are unavoidable.
This is not an absolute guarantee but nothing is.
Am I wrong that suggestions to upgrade apt with Acquire::Retries=0 is
the proper way to handle this specific case? Is there a specific reason
why installer is not affected?
