[Bug 1370416] [NEW] Central and German package servers ship different state of the same package marked as the same version

Launchpad Bug Tracker 1370416 at bugs.launchpad.net
Fri Sep 19 21:53:15 UTC 2014


*** This bug is a security vulnerability ***

You have been subscribed to a public security bug:

I have two machines, both on Kubuntu 14.04 amd64, one on the German package server, one on the central one.
/etc/apt/sources.list for German server attached, for English server will follow in a comment because I can only attach one to the initial report
/etc/apt/sources.list.d is empty

Both have the same version of openjdk-7-jre installed according to aptitude (7u65-2.5.1-4ubuntu1~0.14.04.2).
Both show an update to 7u65-2.5.2-3~14.04 in aptitude.
However, the one with the German server shows it as security update according to aptitude, while the central server shows it as regular update. The package list was updated on both in the same interval of a few seconds.
Why?
[Notice that this might affect other packages, I am seeing more differing updates, only bothering to check the versions for this one.]

Notice that this was preceded by weeks of aptitude telling me about bad
signature / bad checksum when updating the package list (which made me
switch the server to central server on one machine), and your recent
update of apt which seemed to fix security issues in apt according to
the changelog. This is very suspicious to me. Are you hacked? Am I being
hacked? I work on a high value target software (Internet anonymization),
so this scares me.

Please reply soon if you need further information about the state of my
apt, I can only postpone the security updates for a short time, and
afterwards the state of apt might have changed in a way which makes it
impossible to debug.

** Affects: aptitude (Ubuntu)
     Importance: Undecided
         Status: Invalid

-- 
Central and German package servers ship different state of the same package marked as the same version
https://bugs.launchpad.net/bugs/1370416
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to aptitude in Ubuntu.



More information about the foundations-bugs mailing list