On 11/11/2026 11:55 pm, monodev wrote:
On 11/10/26 7:42 PM, Max Nikulin wrote:
On 10/11/2026 1:24 am, Andrew M.A. Cater wrote:
That attacker also has to regenerate all GPG signatures on the archive,
and sign hashes and sizes accordingly.
It is not my reading of
<https://security-tracker.debian.org/tracker/CVE-2026-109518>.
I have not tried it in action, but my impression is that it is enough to
intercept some HTTP requests. A downloaded deb package with correct
checksum may be replaced with a dangerous one before install step.
[...]
Am I wrong that suggestions to upgrade apt with Acquire::Retries=0 is
the proper way to handle this specific case? Is there a specific reason
why installer is not affected?
As stated elsewhere in the thread, apparently the installer is not
affected by CVE-2026-109518 due to not using apt during the
bootstrapping process, and by the time apt can be used it is already
upgraded to the latest and secure version.
I am in doubts if it is really so, that is why I raised the question
again. I suspect, Andrew oversimplified writing that response. Of
course, installer uses packages from the image and apt is not used on
that step. However to get security updates without apt it is necessary
effectively to reimplement apt. From my point of view, it unnecessary
burden since it is much easier to just use apt.
I do not mind that new system is not vulnerable as soon as security
updates are installed. So the window for attacks is narrow, but it exists.
On 12/11/2026 12:07 am, monodev wrote:
For any
install that has upgraded its ca-certificates prior to the disclosure of
CVE-2026-109518, both Acquire::Retries=0 and using HTTPS are valid
mitigations.
To avoid ambiguity, images
debian-13.7.0-amd64-netinst.iso 2026-09-12
were built before ca-certificates update due to the eMudhra case (DSA
6572-1)
<https://lists.debian.org/msgid-search/[email protected]>
Tue, 20 Oct 2026
On 11/11/2026 11:11 pm, CGS wrote:
CA certificates and Debian's software-signing infrastructure are
different trust mechanisms.
Due to a coincidence both apt and ca-certificates versions in installer
images have serious issues.
