> moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default
Fixed that for you.
Fixed that for you.
CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
[0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/p...
Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution:
CVE-2009-1358 apt-get does not check for the correct error code from gpgv
CVE-2011-1829 APT does not properly validate inline GPG signatures
CVE-2011-3634 APt accepts connections when the certificate host name fails validation
CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature.
etc etc.
Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.