Hacker News Reader

Comment by sczi | Hacker News Reader

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade

Since this also involves redirects, would that protect users while updating apt for this one also?

View on HN

That sounds right to me, but FYI the APT maintainers themselves are recommending Acquire::Retries=0 as the mitigation since some mirrors might actually have redirects.

I saw the ubuntu announcement also defers to the `apt upgrade -o Acquire::Retries=0` recommendation

https://ubuntu.com/blog/apt-vulnerability-fixes-available

Reply on news.ycombinator.com