On 07/11/2026 7:09 pm, Andrew M.A. Cater wrote:
On Sat, Nov 07, 2026 at 10:23:44AM +0000, Elven Inquisition wrote:
Why was there no new ISO released following the cert compromise? Why is there
still no installation media now, following the fix of this critical APT vuln?
You do realise that your network install from any existing .iso file
will do the updates immediately before you even have the first reboot?
Isn't getting updates the moment when the new system may be compromised
if an attacker may act as a MITM (unless the user adjusts APT
configuration)? GPG signature verification may be bypassed in default
configuration. Switching to a HTTPS mirror requires removing of weak TLS
certificates, so Acquire::Retries=0 looks like an easier workaround.
if you *really* want new .iso images, you can wait for approximately
two weeks from now and 13.8 software and images hsould be released
on November 21st.
The specified date is not bad (at least in comparison to some other
projects). My impression that the issues are rather ugly. Perhaps users
should be warned more loudly and the notice should include workarounds.
[2]: https://ubuntu.com/blog/apt-vulnerability-fixes-available
[3]: https://security-tracker.debian.org/tracker/CVE-2026-109518
