Apt vulnerability CVE-2019-3462

[emkll]

Description

CVE-2019-3462 remote code execution in apt when following redirects:
https://justi.cz/security/2019/01/22/apt-rce.html

This would allow an adversary to execute arbitrary code on the server by exploiting a vulnerability in apt.

• For apt served over http, this requires an attacker to either compromise the apt server or be in a privileged networked position.

• For apt served over https, the require must compromise the apt server or be in a privileged network position AND have a valid HTTPS certificate.

deb.torproject.org and apt.freedom.press use https, however, archive.ubuntu.com does not.

Existing installs

Existing installs have already been upgraded to the latest version.

New installs

Before running any apt commands, apt should be updated with -o Acquire::http:AllowRedirect=false