Hacker News Reader

Hacker News

Comment by yeukhon | Hacker News Reader

Full thread

yeukhon

Will Ubuntu server gets the patch in its update? How long does it take to get that update?

View on HN

Given:

* nginx sits in universe rather than main

* There is no mention of a patch for this CVE in the changelogs

* No bug exists in either the Debian bug tracking system nor Launchpad for this particular bug

I'd recommend you download the source (easy: apt-get source nginx), add the patch to quilt and then build it (preferably using pbuilder if you're building a binary package locally).

EDIT: Or use the nginx repository from http://nginx.org/en/linux_packages.html

I would be extremely surprised if Debian did not update it. Ubuntu I'm less sure about, mostly because I'm less familiar with their security update policies.

I have heard from people who work in operating security at tech giants that they don't build from source or use ppa because to them stable release is stable and if a release is tag stable for a specific ubuntu release it means it has met the standard. I am not sure if this is crap or what. When I run my own in-house apps I use the latest from ppa.

It's mostly crap. What you get with universe and multiverse packages is essentially a snapshot of Debian development at the time U+1 was forked from Debian testing or unstable. There are packages which are also in the stable branch of Debian or may later become packages in that branch, but often more changes are made before it goes into the next Debian stable release.

Secondly, a package in Debian stable mustn't have any applicable release critical bugs at the time the release is made. If after release a package (in Debian, Ubuntu or any other derivative) is discovered to allow for remote code execution in its default configuration for instance, there's no hiding behind what it says on the tin. The bug doesn't care how it's labeled and you should act on it.

Thirdly, packages in universe and multiverse only get community support, as opposed to support from Canonical for the duration of the support cycle. The entire point of having a repository system (like apt or yum) is that you can mix and match them to your liking and choose which packages may come from which source. So if you can get better support elsewhere, there should be no stopping you from subscribing to that support channel.

Personal package archives I'd generally not recommend because they may not be vetted as well as the more official repositories and the support commitment (when it exists) might not be at the same level. Could be better or worse, but you'll have to evaluate that on a case-by-case basis.

> No bug exists in ... the Debian bug tracking system

There is one now: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012

And now fixed in Debian: http://ftp-master.metadata.debian.org/changelogs/main/n/ngin...

> I'd recommend you download the source (easy: apt-get source nginx), add the patch to quilt and then build it (preferably using pbuilder if you're building a binary package locally).

If you can fix the bug in packaging, why not submit the fix and make it available to all Ubuntu users? As you say, nginx is in universe. This means that it is community supported, and anybody can contribute the fix (in the form of a debdiff with the quilted patch, as you describe) and have it sponsored and the package updated.

Reply on news.ycombinator.com