On 11/10/26 7:42 PM, Max Nikulin wrote: > On 10/11/2026 1:24 am, Andrew M.A. Cater wrote: >> That attacker also has to regenerate all GPG signatures on the archive, >> and sign hashes and sizes accordingly. > > It is not my reading of > <https://security-tracker.debian.org/tracker/CVE-2026-109518>. > I have not tried it in action, but my impression is that it is enough to > intercept some HTTP requests. A downloaded deb package with correct > checksum may be replaced with a dangerous one before install step. > > [...] > > Am I wrong that suggestions to upgrade apt with Acquire::Retries=0 is > the proper way to handle this specific case? Is there a specific reason > why installer is not affected?
As stated elsewhere in the thread, apparently the installer is not affected by CVE-2026-109518 due to not using apt during the bootstrapping process, and by the time apt can be used it is already upgraded to the latest and secure version. The bit concerning regenerating all GPG signatures is about how the bootstrapping process itself might be compromised, which requires a lot more than fake TLS certs (at the minimum the compromise of Debian's own keys), so is well beyond the scope of what can be achieved through eMudhra + CVE-2026-109518. So upgrading with Acquire::Retries=0 is not a necessity for new installs. It is a necessity for any install that has not upgraded its ca-certificates prior to upgrading apt. For any install that has upgraded its ca-certificates prior to apt, both Acquire::Retries=0 and using HTTPS are valid mitigations. - monodev
