logoalt Hacker News

sczi • today at 4:39 PM • 1 reply • view on HN

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade
Since this also involves redirects, would that protect users while updating apt for this one also?

Replies

justicz • today at 6:16 PM

That sounds right to me, but FYI the APT maintainers themselves are recommending Acquire::Retries=0 as the mitigation since some mirrors might actually have redirects.