MX Linux Forum

anybody else see this? Debian Security Advisory

- mike

Is it this? viewtopic.php?f=97&t=48093&p=480883

and already patched last nite I believe. You should see apt in your updates.

I did the updates yesterday when they came through Synaptic. I wasn't then aware of the need to do should I now remove those packages and run these codes and reinstall?

philotux wrote: Wed Jan 23, 2019 8:52 am I did the updates yesterday when they came through Synaptic. I wasn't then aware of the need to do

Code: Select all

apt -o Acquire::http::AllowRedirect=false update
apt -o Acquire::http::AllowRedirect=false upgrade

should I now remove those packages and run these codes and reinstall?

I think its already done.

The suggestion from debian was to avoid man-in-the-middle attacks while doing the update. Once the update is done, you're done. The suggestion is a little cautious to do the manual disable of AllowRedirect, even if its technically a correct suggestion.

All is well then. Thanks!

thanks. I missed the other post.

the patch was published (in Debian) and we were able to update before the press release was made.
...


I assume MX has those updates also, but not really sure.

philotux wrote: Wed Jan 23, 2019 8:52 am I did the updates yesterday when they came through Synaptic. I wasn't then aware of the need to do

Code: Select all

apt -o Acquire::http::AllowRedirect=false update
apt -o Acquire::http::AllowRedirect=false upgrade

should I now remove those packages and run these codes and reinstall?

You can't really remove and reinstall them because removing them results in the removal of most of the other package management tools too including synaptic, gdebi & aptitude which will make it difficult to reinstall things. (you might be able to reinstall the packages with dpkg)

kmathern wrote: Wed Jan 23, 2019 9:12 am You can't really remove and reinstall them because removing them results in the removal of most of the other package management tools too including synaptic, gdebi & aptitude which will make it difficult to reinstall things. (you might be able to reinstall the packages with dpkg)

Thank's for this! I had no idea!

So glad to see this activity. I'd just seen the following story in my news feed: https://www.zdnet.com/article/nasty-sec ... linux-apt/

"...was recently found to have a serious security hole. It's now patched."
...so it was found an patched before we ever heard of it. Thanks Debian!

I wonder, was this ever a real problem, as in did a hacker ever use that hole and do something?
Not just "a proof of concept"