HTTP redirect vulnerability in apt package manager

Ironic, given the previous discussion on why apt shouldn't use HTTPS connections. With full end-to-end SSL validation, this kind of vulnerability can't exist. Should be interesting to see how the community reacta to this.

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

Discussed on HN:

https://news.ycombinator.com/item?id=18968370

Please use the original title.