Isar APT Snapshot Date Handling Vulnerability Leading to Missed Security Updates

A vulnerability exists in Isar versions 0.11-rc1 and 0.11, where the ISAR_APT_SNAPSHOT_DATE variable, when set alone, does not correctly update the timestamp for the security distribution. This oversight can cause users to miss critical security updates. The issue arises because the security distribution timestamp defaults to an unintended value derived from the ISAR_APT_SNAPSHOT_TIMESTAMP variable, which is based on the source date epoch. As a result, users may inadvertently install older, unpatched packages.

Impact

This vulnerability can lead to the installation of outdated packages that lack important security patches, potentially exposing systems to known vulnerabilities.

Remediation

Users can manually set the ISAR_APT_SNAPSHOT_TIMESTAMP[security] or ISAR_APT_SNAPSHOT_DATE[security] variables to ensure the correct timestamp is used for security updates. The vulnerability has also been patched in the Isar repository.