Debian Security Advisory DSA-4371-1 apt -- security update

[Nasty7]

Do you guys have advice for us low level users on this flaw?
Debian Security Advisory DSA-4371-1 apt -- security update
Just run these commands or don't worry about it. After all it's just a flaw at this point and I have not seen any exploits yet.

[FONT=monospace]apt -o Acquire::http::AllowRedirect=false update[/FONT]
[FONT=monospace]apt -o Acquire::http::AllowRedirect=false upgrade[/FONT]

I just updated Thursday night but had not seen this yet, and I've not been running Rkhunter as I used to.

Nasty7

[jglen490]

Debian is pretty far "upstream. I would check with Ubuntu Security Notices first to see what's up in the *buntu world.

[Nasty7]

Well first off, I forgot the Link lol, edited and fixed. Second, I don't understand the Ubuntu Launchpad page as usual. I assume we should use the 'Downloads' for apt on that page and install the apt fix to avoid the issue. But I already Updated, so if there were some remote chance of infection it could have already happened. But I don't believe all the hype as usual, and am not too concerned, but like to be preventative if possible.

My next move is to check 'apt' version to see if I installed the fix my last update? I'm documenting this as I'm thinking about it now and am not on Kubuntu, and hopefully other average users can benefit.

Check 'apt' Version

apt-cache policy apt

[Nasty7]

USN-3863-1: APT vulnerability Ubuntu

As I suspected already have the patch. Good to go!

[FONT=monospace]sudo apt-cache policy apt
 
apt:
Installed: 1.6.6ubuntu0.1
Candidate: 1.6.6ubuntu0.1
Version table:
*** 1.6.6ubuntu0.1 500
      500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
      500 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages
      100 /var/lib/dpkg/status
   1.6.1 500
      500 http://us.archive.ubuntu.com/ubuntu bionic/main amd64 Packages

[/FONT]

[jglen490]

I was going to suggest

dpkg -l apt*

which shows the same result - problem fixed! Keep that USN site URL handy, too.
It's all good ...

[Nasty7]

Did yours look like this also?

[FONT=monospace]dpkg -l apt*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                 Version                 Architecture            Description
+++-====================================-=======================-=======================-=============================================================================
ii  apt                                  1.6.6ubuntu0.1          amd64                   commandline package manager
ii  apt-config-icons                     0.12.0-3ubuntu1         all                     APT configuration snippet to enable icon downloads
ii  apt-config-icons-hidpi               0.12.0-3ubuntu1         all                     APT configuration snippet to enable HiDPI icon downloads
ii  apt-config-icons-large               0.12.0-3ubuntu1         all                     APT configuration snippet to enable large icon downloads
ii  apt-config-icons-large-hidpi         0.12.0-3ubuntu1         all                     APT configuration snippet to enable large HiDPI icon downloads
un  apt-doc                              <none>                  <none>                  (no description available)
un  apt-listbugs                         <none>                  <none>                  (no description available)
un  apt-listchanges                      <none>                  <none>                  (no description available)
un  apt-transport-https                  <none>                  <none>                  (no description available)
ii  apt-utils                            1.6.6ubuntu0.1          amd64                   package management related utility programs
ii  apt-xapian-index                     0.47ubuntu13            all                     maintenance and search tools for a Xapian index of Debian packages
un  aptitude                             <none>                  <none>                  (no description available)

[/FONT]

[jglen490]

Yep! The first line shows the installed apt version number, which matches what the security notification solution showed on USN.