Re: [SECURITY] [DLA 1637-1] apt security update (amended)

2019-01-22 Thread Julien Cristau
On 1/23/19 7:00 AM, Abhijith PA wrote: > > Hi. > > My sbuild setup fails to build packages in jessie. > > W: Failed to fetch > gzip:/var/lib/apt/lists/partial/_build_pdns-recursor-mVttBC_resolver-NUo8FV_apt%5farchive_._Sources.gz > Invalid file format > > E: Some index files failed to download

Re: [SECURITY] [DLA 1637-1] apt security update (amended)

2019-01-22 Thread Abhijith PA
Hi. My sbuild setup fails to build packages in jessie. W: Failed to fetch gzip:/var/lib/apt/lists/partial/_build_pdns-recursor-mVttBC_resolver-NUo8FV_apt%5farchive_._Sources.gz Invalid file format E: Some index files failed to download. They have been ignored, or old ones used instead. E: Upd

Re: [SECURITY] [DLA 1637-1] apt security update (amended)

2019-01-22 Thread Jason Guto
Would it be best practice to disable HTTP connections for apt and is the latter even possible? Thank you On Tue, Jan 22, 2019 at 9:55 AM Julian Andres Klode wrote: > > Package: apt > Version: 1.0.9.8.5 > CVE ID : CVE-2019-3462 > Debian Bug : > > (amended to refer to j

Re: [SECURITY] [DLA 1637-1] apt security update (amended)

2019-01-22 Thread Jason Guto
jasongutow...@westat.com On Tue, Jan 22, 2019 at 9:55 AM Julian Andres Klode wrote: > > Package: apt > Version: 1.0.9.8.5 > CVE ID : CVE-2019-3462 > Debian Bug : > > (amended to refer to jessie in the sources.list entry below, instead of > stable) > > Max Justicz disc

Re: [SECURITY] [DLA 1637-1] apt security update

2019-01-22 Thread Thorsten Glaser
On Tue, 22 Jan 2019, Julian Andres Klode wrote: > > jessie/updates! Using stable/updates will break the system > > and keep back apt! > > Sorry, I missed that bit while updating the email from the DSA :( Don't worry, this happens, we're all humans, but please send an updated announcement quickly

Re: [SECURITY] [DLA 1637-1] apt security update

2019-01-22 Thread Julian Andres Klode
On Tue, Jan 22, 2019 at 03:49:22PM +0100, Thorsten Glaser wrote: > On Tue, 22 Jan 2019, Julian Andres Klode wrote: > > > This is known to break some proxies when used against security.debian.org. > > If > > that happens, people can switch their security APT source to use: > > > > deb http://cdn

Re: [SECURITY] [DLA 1637-1] apt security update

2019-01-22 Thread Thorsten Glaser
On Tue, 22 Jan 2019, Julian Andres Klode wrote: > This is known to break some proxies when used against security.debian.org. If > that happens, people can switch their security APT source to use: > > deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main jessie/updates! Using