Package: debian-cd Severity: normal Tags: upstream Dear Maintainer,
as described in https://lists.debian.org/debian-cd/2018/01/msg00019.html the *.jigdo files are not listed in the checksum files *SUMS. There is no way provided to check the authenticity of *.jigdo before downloading by jigdo-lite begins. The *.jigdo file provides package file paths, the URLs of fallback mirrors, and the cheksum of the *.template file. So *.template can inflate to an image of arbitrary size and jigdo-lite can be lured into downloading arbitrary URLs. Have a nice day :) Thomas
