Hacker News Reader

Comment by Mathnerd314 | Hacker News Reader

The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster (https://askubuntu.com/questions/445487/what-debian-version-a...) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it updated in LTS releases.

tl;dr Avoid Ubuntu LTS because they don't maintain their packages properly.

View on HN

Stretch is supposed to keep getting security fixes until June 2022 but this particular library doesn't have the fix backported yet: https://security-tracker.debian.org/tracker/CVE-2019-13615

Does anybody know why libebml wasn't fixed yet in Stretch?

There was never a CVE for it (until the CVE for VLC) so I'm guessing the Debian Security Team never found out about it.

The package in Debian was updated four days before Ubuntu 18.04 was released. That's why the update didn't make 18.04 "automatically".

Since then, both Debian and Ubuntu have acted the same: not knowing about the vulnerability, neither updated their [release] packages. Buster happened to have been updated before it was frozen for release. Stretch was not, and neither was 18.04.

> tl;dr Avoid Ubuntu LTS because they don't maintain their packages properly.

By your logic, you should also avoid Debian then, since they followed the same process here. What got updated and what didn't was merely an accident of calendar freeze dates.

At the time I write this, Debian stretch is still on 1.3.4-1 and hasn't been updated. Ubuntu 18.04 has now been updated.

> By your logic, you should also avoid Debian then

It's true, I was looking at Debian testing & sid as possibilities but apparently they can't handle mass rebuilds very well and the recommended workaround is to just not update. So rolling distros only for me. (current NixOS)

Reply on news.ycombinator.com