This bug was fixed in the package ubuntu-release-upgrader - 1:16.04.27

---------------
ubuntu-release-upgrader (1:16.04.27) xenial; urgency=medium

  * Use HTTPS for changelogs.ubuntu.com (LP: #1744318)
  * Run pre-build script to update mirror list, hold apt-btrfs-snapshot changes

 -- Julian Andres Klode <juli...@ubuntu.com>  Wed, 02 Oct 2019 16:08:25
+0200

** Changed in: ubuntu-release-upgrader (Ubuntu Xenial)
       Status: Fix Committed => Fix Released

** Changed in: update-manager (Ubuntu Xenial)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1744318

Title:
  changelogs.ubuntu.com should be using HTTPS

Status in ubuntu-release-upgrader package in Ubuntu:
  Fix Released
Status in update-manager package in Ubuntu:
  Fix Released
Status in ubuntu-release-upgrader source package in Xenial:
  Fix Released
Status in update-manager source package in Xenial:
  Fix Released
Status in ubuntu-release-upgrader source package in Bionic:
  Fix Released
Status in update-manager source package in Bionic:
  Fix Released

Bug description:
  [Impact]
  Although the packages listed in meta-release files on changelogs.ubuntu.com 
are signature-checked there doesn't appear to be any way to verify the 
meta-release files are valid so a man-in-the-middle could maliciously supply an 
alternate meta-release.

  meta-release files should be signed with the archive GPG key and/or
  delivered over HTTPS.

  [Test case]
  Block port 80 access to changelogs.ubuntu.com and check that 
do-release-upgrade still works

  [Regression potential]
  This breaks any clients behind a proxy where HTTPS (CONNECT on the proxy) is 
not allowed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1744318/+subscriptions

_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to     : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp

Reply via email to