Hi, Thomas Williams <[email protected]> wrote on 25/08/2026 at 13:58:55+0200:
> You may want to consider taking that link down if the reported > vulnerabilities are true, as you've e-mailed a public mailing > list, not the debian security team. He may. But that being said, looking at the whole, this seems like an AI-driven report with not enough context and details to act upon. A quick glance at the descriptions: 1. The default kernel config mitigates the "attack". True, this doesn't mean en unsafe pattern should not be fixed, but I also note that Dir::Apport is root-controlled configuration, so exploitability under a deliberately unsafe configuration is not automatically an apt vulnerability. Without a proper description of the attacker, file ownership and modes and privileges gained, this looks low to no prio. But I could have missed something. 2. apt not being SUID, if modifying PAGER/APT_PAGER has an impact, it's either because it's done as root, or because one does set these variables, with a sudo call, having allowed sudo to export these variables. Shell-based pager vars are intentional, and being able to run "PAGER=XXX apt YYY" as root is no privilege escalation. 3. The claim is strong. First we'd need to see how the attacker-controlled repo metadata survive apt's validation and quoting to reach the shell (and no, I won't click a random google drive, I want text and explanations in a mail). "confirmed by source code review" is not a proof. All in all, except if someone with some free time or apt expertise deem it otherwise, I'd just ignore the mail. -- PEB
signature.asc
Description: PGP signature
