Incorrect package version available on bionic pool (2.7.17-1~18.04ubuntu1.3 not availbale)

[Ivan]

Apt tries to get the python2.7 package and some of its dependencies with version (2.7.17-1~18.04ubuntu1.3). However it returns an error with:

Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/p/python2.7/python2.7-minimal_2.7.17-1~18.04ubuntu1.3_amd64.deb 404 Not Found [IP: 91.189.88.152 80]

The problem is present on BIONIC distro

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Matias N. Goldberg (dark-sylinc)]

This bug should be marked as CRITICAL and be fixed ASAP. It's preventing automatic security upgrades.

Hopefully this was a mistake by a packager, but investigation should be made in order to check this isn't a Supply Chain Attack

More info on apt output:

Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following NEW packages will be installed:
  linux-headers-5.4.0-66-generic linux-hwe-5.4-headers-5.4.0-66 linux-image-5.4.0-66-generic linux-modules-5.4.0-66-generic linux-modules-extra-5.4.0-66-generic
The following packages have been kept back:
  mesa-va-drivers mesa-va-drivers:i386 mesa-vulkan-drivers:i386
The following packages will be upgraded:
  dirmngr dnsmasq-base gnupg gnupg-agent gnupg-l10n gnupg-utils gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm gpgv idle-python2.7 idle-python3.6 libpython2.7 libpython2.7-dev
  libpython2.7-minimal libpython2.7-stdlib libpython3.6 libpython3.6-dev libpython3.6-minimal libpython3.6-stdlib linux-generic-hwe-18.04 linux-headers-generic-hwe-18.04 linux-image-generic-hwe-18.04
  linux-libc-dev python-httplib2 python2.7 python2.7-dev python2.7-minimal python3-httplib2 python3.6 python3.6-dev python3.6-minimal retroarch xterm
37 upgraded, 5 newly installed, 0 to remove and 3 not upgraded.
Need to get 33,4 MB/166 MB of archives.
After this operation, 349 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Ign:1 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7-dev amd64 2.7.17-1~18.04ubuntu1.3
Ign:2 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7-dev amd64 2.7.17-1~18.04ubuntu1.3
Ign:3 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7 amd64 2.7.17-1~18.04ubuntu1.3
Ign:4 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7 amd64 2.7.17-1~18.04ubuntu1.3
Ign:5 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7-stdlib amd64 2.7.17-1~18.04ubuntu1.3
Ign:6 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7-minimal amd64 2.7.17-1~18.04ubuntu1.3
Ign:7 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7-minimal amd64 2.7.17-1~18.04ubuntu1.3
Err:1 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7-dev amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:2 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7-dev amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:3 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7 amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:4 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7 amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:5 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 libpython2.7-stdlib amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:6 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7-minimal amd64 2.7.17-1~18.04ubuntu1.3
  404 Not Found [IP: 91.189.91.39 80]
Err:7 ...

[Ruslan Skriabin (russkr)]

Same for Ubuntu 16.04.7:

Err:1 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 python2.7 amd64 2.7.12-1ubuntu0~16.04.14
  404 Not Found [IP: 91.189.88.142 80]
Err:2 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 libpython2.7-stdlib amd64 2.7.12-1ubuntu0~16.04.14
  404 Not Found [IP: 91.189.88.142 80]
Err:3 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 python2.7-minimal amd64 2.7.12-1ubuntu0~16.04.14
  404 Not Found [IP: 91.189.88.142 80]
Err:4 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 libpython2.7-minimal amd64 2.7.12-1ubuntu0~16.04.14
  404 Not Found [IP: 91.189.88.142 80]
Err:5 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 libpython2.7 amd64 2.7.12-1ubuntu0~16.04.14
  404 Not Found [IP: 91.189.88.142 80]

# apt-cache policy python2.7
python2.7:
  Installed: 2.7.12-1ubuntu0~16.04.13
  Candidate: 2.7.12-1ubuntu0~16.04.14
  Version table:
     2.7.12-1ubuntu0~16.04.14 500
        500 http://archive.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
 *** 2.7.12-1ubuntu0~16.04.13 100
        100 /var/lib/dpkg/status
     2.7.11-7ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages

[Colin Watson (cjwatson)]

This update was broken and intentionally reverted. There should be a USN update coming soon, and it will be superseded by a newer version, but it was better to quickly withdraw the update to avoid causing serious breakage.

[Colin Watson (cjwatson)]

The bug report about the regression is bug 1916893, and now links to https://ubuntu.com/security/notices/USN-4754-2, so I'm just going to mark this as a duplicate of that bug.