{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520","repository_url":"https://api.github.com/repos/QubesOS/qubes-issues","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/2520","id":195828471,"number":2520,"title":"Debian, Whonix, Ubuntu - apt-get upgrading security issue CVE-2016-1252","user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"labels":[{"id":401292621,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20Debian","name":"C: Debian","color":"cccccc","default":false},{"id":354469647,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20Whonix","name":"C: Whonix","color":"cccccc","default":false},{"id":184545385,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/P:%20critical","name":"P: critical","color":"e11d21","default":false},{"id":420799633,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/security","name":"security","color":"000000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/24","html_url":"https://github.com/QubesOS/qubes-issues/milestone/24","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/24/labels","id":2145500,"number":24,"title":"Release 3.2 updates","description":"Updates for stable release","creator":{"login":"marmarek","id":726704,"avatar_url":"https://avatars.githubusercontent.com/u/726704?v=3","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"open_issues":97,"closed_issues":19,"state":"open","created_at":"2016-11-19T00:33:44Z","updated_at":"2016-12-24T11:07:43Z","due_on":null,"closed_at":null},"comments":71,"created_at":"2016-12-15T15:05:36Z","updated_at":"2016-12-27T18:42:02Z","closed_at":null,"body":"#### Qubes OS version (e.g., `R3.2`):\r\n\r\nall\r\n\r\n#### Affected TemplateVMs (e.g., `fedora-23`, if applicable):\r\n\r\nall Debian based templates, all Whonix templates [and Ubuntu templates]\r\n\r\n---\r\n\r\nVery short summary of the bug:\r\n(my own words) During apt-get upgrading signature verification can be tricked resulting in arbitrary package installation, template compromise.\r\n\r\nsources:\r\n\r\n* https://security-tracker.debian.org/tracker/CVE-2016-1252\r\n* https://www.debian.org/security/2016/dsa-3733\r\n* https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467\r\n* https://lists.debian.org/debian-security-announce/2016/msg00316.html\r\n\r\n(Specifically dangerous when upgrading over Tor. Slightly less dangerous when upgrading over onions mirrors [boils down to trust, i.e. IF the onion mirror is not compromised by that time].)\r\n\r\n---\r\n\r\nSuggested solution for downloadable Qubes templates:\r\nRebuild all templates. No changes besides building them with newer Debian packages (from jessie-security).\r\n\r\n---\r\n\r\nSolution for existing templates?\r\n\r\n* just have users upgrade them and hope they'll not be compromised during doing so?\r\n* some better solution to security upgrade templates? (perhaps manually downloading and verifying the patched apt-get package)\r\n* recommend to reinstall the template?\r\n* Release a Qubes Security Bulletin?"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/269365450","html_url":"https://github.com/QubesOS/qubes-issues/issues/2520#issuecomment-269365450","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520","id":269365450,"user":{"login":"tasket","id":14337937,"avatar_url":"https://avatars.githubusercontent.com/u/14337937?v=3","gravatar_id":"","url":"https://api.github.com/users/tasket","html_url":"https://github.com/tasket","followers_url":"https://api.github.com/users/tasket/followers","following_url":"https://api.github.com/users/tasket/following{/other_user}","gists_url":"https://api.github.com/users/tasket/gists{/gist_id}","starred_url":"https://api.github.com/users/tasket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tasket/subscriptions","organizations_url":"https://api.github.com/users/tasket/orgs","repos_url":"https://api.github.com/users/tasket/repos","events_url":"https://api.github.com/users/tasket/events{/privacy}","received_events_url":"https://api.github.com/users/tasket/received_events","type":"User","site_admin":false},"created_at":"2016-12-27T18:42:02Z","updated_at":"2016-12-27T18:42:02Z","body":"@marmarek In that case, it would be prudent to add a comment to the install instructions warning users to download Debian separately."}}
{"actor":{"display_login":"tasket"}}