This bug was fixed in the package ubuntu-release-upgrader - 1:16.04.27 --------------- ubuntu-release-upgrader (1:16.04.27) xenial; urgency=medium
* Use HTTPS for changelogs.ubuntu.com (LP: #1744318) * Run pre-build script to update mirror list, hold apt-btrfs-snapshot changes -- Julian Andres Klode <[email protected]> Wed, 02 Oct 2019 16:08:25 +0200 ** Changed in: ubuntu-release-upgrader (Ubuntu Xenial) Status: Fix Committed => Fix Released ** Changed in: update-manager (Ubuntu Xenial) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1744318 Title: changelogs.ubuntu.com should be using HTTPS Status in ubuntu-release-upgrader package in Ubuntu: Fix Released Status in update-manager package in Ubuntu: Fix Released Status in ubuntu-release-upgrader source package in Xenial: Fix Released Status in update-manager source package in Xenial: Fix Released Status in ubuntu-release-upgrader source package in Bionic: Fix Released Status in update-manager source package in Bionic: Fix Released Bug description: [Impact] Although the packages listed in meta-release files on changelogs.ubuntu.com are signature-checked there doesn't appear to be any way to verify the meta-release files are valid so a man-in-the-middle could maliciously supply an alternate meta-release. meta-release files should be signed with the archive GPG key and/or delivered over HTTPS. [Test case] Block port 80 access to changelogs.ubuntu.com and check that do-release-upgrade still works [Regression potential] This breaks any clients behind a proxy where HTTPS (CONNECT on the proxy) is not allowed. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1744318/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : [email protected] Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
