The vulnerability exists in the HTTP backend invoked by the APT library, and affects any APT-based frontend (apt, apt-get, aptitude, or any of the Ubuntu graphical applications).
The use of TLS via HTTPS protects against this vulnerability, as exploitation requires the attacker to manipulate HTTP traffic.
What a fucking surprise. They’ve been trying to justify using HTTP for apt repositories with the excuse “but every package is signed by GPG.” Well guess what, fuckers! WE FUCKING TOLD YOU SO!
And in the next year we’re going to see you proven right so many times we’ll beg it to stop - but it won’t instead it’ll get worse. The CVE graph is becoming exponential. Rumor on the street (and by street I mean blind app) is that the larger unreleased models SOTA labs have are a significant improvement, so much so they’ll likely never be released to the general public.
Anyways, this K shaped shitheap is going to hurt I hope you’re wearing your seatbelt…
What a fucking surprise. They’ve been trying to justify using HTTP for apt repositories with the excuse “but every package is signed by GPG.” Well guess what, fuckers! WE FUCKING TOLD YOU SO!
Such a vulnerability could exist in any protocol… Like TCP in the Linux kernel
And in the next year we’re going to see you proven right so many times we’ll beg it to stop - but it won’t instead it’ll get worse. The CVE graph is becoming exponential. Rumor on the street (and by street I mean blind app) is that the larger unreleased models SOTA labs have are a significant improvement, so much so they’ll likely never be released to the general public.
Anyways, this K shaped shitheap is going to hurt I hope you’re wearing your seatbelt…