6 ms·

Given: * nginx sits in universe rather than main * There is no mention of a patch for this CVE in the changelogs * No bug exists in either the Debian bug tra

Given: * nginx sits in universe rather than main * There is no mention of a patch for this CVE in the changelogs * No bug exists in either the Debian bug tracking system nor Launchpad for this particular bug I'd recommend you download the source (easy: apt-get source nginx), add the patch to quilt and then build it (preferably using pbuilder if you're building a binary package locally). EDIT: Or use the nginx repository from http://nginx.org/en/linux_packages.html http://nginx.org/en/linux_packages.html

BCM43 13y ago
I would be extremely surprised if Debian did not update it. Ubuntu I'm less sure about, mostly because I'm less familiar with their security update policies.
yeukhon 13y ago
I have heard from people who work in operating security at tech giants that they don't build from source or use ppa because to them stable release is stable and if a release is tag stable for a specific ubuntu release it means it has met the standard. I am not sure if this is crap or what. When I run my own in-house apps I use the latest from ppa.
- brokenparser 13y ago
  It's mostly crap. What you get with universe and multiverse packages is essentially a snapshot of Debian development at the time U+1 was forked from Debian testing or unstable. There are packages which are also in the stable branch of Debian or may later become packages in that branch, but often more changes are made before it goes into the next Debian stable release. Secondly, a package in Debian stable mustn't have any applicable release critical bugs at the time the release is made. If after release a package (in Debian, Ubuntu or any other derivative) is discovered to allow for remote code execution in its default configuration for instance, there's no hiding behind what it says on the tin. The bug doesn't care how it's labeled and you should act on it. Thirdly, packages in universe and multiverse only get community support, as opposed to support from Canonical for the duration of the support cycle. The entire point of having a repository system (like apt or yum) is that you can mix and match them to your liking and choose which packages may come from which source. So if you can get better support elsewhere, there should be no stopping you from subscribing to that support channel. Personal package archives I'd generally not recommend because they may not be vetted as well as the more official repositories and the support commitment (when it exists) might not be at the same level. Could be better or worse, but you'll have to evaluate that on a case-by-case basis.
_delirium 13y ago
> No bug exists in ... the Debian bug tracking system There is one now: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012
- _delirium 13y ago
  And now fixed in Debian: http://ftp-master.metadata.debian.org/changelogs/main/n/nginx/unstable_changelog http://ftp-master.metadata.debian.org/changelogs/main/n/ngin...
rlpb 13y ago
> I'd recommend you download the source (easy: apt-get source nginx), add the patch to quilt and then build it (preferably using pbuilder if you're building a binary package locally). If you can fix the bug in packaging, why not submit the fix and make it available to all Ubuntu users? As you say, nginx is in universe. This means that it is community supported, and anybody can contribute the fix (in the form of a debdiff with the quilted patch, as you describe) and have it sponsored and the package updated.

BCM43 13y ago

I would be extremely surprised if Debian did not update it. Ubuntu I'm less sure about, mostly because I'm less familiar with their security update policies.

yeukhon 13y ago

I have heard from people who work in operating security at tech giants that they don't build from source or use ppa because to them stable release is stable and if a release is tag stable for a specific ubuntu release it means it has met the standard. I am not sure if this is crap or what. When I run my own in-house apps I use the latest from ppa.

brokenparser 13y ago
It's mostly crap. What you get with universe and multiverse packages is essentially a snapshot of Debian development at the time U+1 was forked from Debian testing or unstable. There are packages which are also in the stable branch of Debian or may later become packages in that branch, but often more changes are made before it goes into the next Debian stable release. Secondly, a package in Debian stable mustn't have any applicable release critical bugs at the time the release is made. If after release a package (in Debian, Ubuntu or any other derivative) is discovered to allow for remote code execution in its default configuration for instance, there's no hiding behind what it says on the tin. The bug doesn't care how it's labeled and you should act on it. Thirdly, packages in universe and multiverse only get community support, as opposed to support from Canonical for the duration of the support cycle. The entire point of having a repository system (like apt or yum) is that you can mix and match them to your liking and choose which packages may come from which source. So if you can get better support elsewhere, there should be no stopping you from subscribing to that support channel. Personal package archives I'd generally not recommend because they may not be vetted as well as the more official repositories and the support commitment (when it exists) might not be at the same level. Could be better or worse, but you'll have to evaluate that on a case-by-case basis.

_delirium 13y ago

> No bug exists in ... the Debian bug tracking system There is one now: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012

_delirium 13y ago
And now fixed in Debian: http://ftp-master.metadata.debian.org/changelogs/main/n/nginx/unstable_changelog http://ftp-master.metadata.debian.org/changelogs/main/n/ngin...

rlpb 13y ago

> I'd recommend you download the source (easy: apt-get source nginx), add the patch to quilt and then build it (preferably using pbuilder if you're building a binary package locally). If you can fix the bug in packaging, why not submit the fix and make it available to all Ubuntu users? As you say, nginx is in universe. This means that it is community supported, and anybody can contribute the fix (in the form of a debdiff with the quilted patch, as you describe) and have it sponsored and the package updated.