16

In my Debian machine, the current version of apache2 is 2.4.10:

root@9dd0fd95a309:/# apachectl -V
Server version: Apache/2.4.10 (Debian)

I would like to upgrade apache to a latest version (at least 2.4.26): I tried: 

root@9dd0fd95a309:/# apt-get install apache2
Reading package lists... Done
Building dependency tree
Reading state information... Done
apache2 is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 48 not upgraded.

But it doesn't find any update. What can i do to upgrade to a latest version ?

enter image description here

Improve this question
11
  • 1
    Why do you want to upgrade?
    – Stephen Kitt
    Nov 12, 2017 at 15:18
  • 1
    @wawanopoulos: Jessie is still supported so you should expect security patches or backports to show up even if the version number differs from upstream.
    – Kevin
    Nov 12, 2017 at 16:37
  • 1
    There’s nothing to fix.
    – Stephen Kitt
    Nov 12, 2017 at 17:16
  • 1
    They are fixed in the Debian package. The Tenable report is based purely on version numbers, which unfortunately doesn’t work with many distribution packages.
    – Stephen Kitt
    Nov 12, 2017 at 17:42
  • 1
    Which version are you running exactly? (dpkg -l apache2, ensure your terminal is wide enough to display the full version number)
    – marcelm
    Nov 12, 2017 at 20:28

6 Answers 6

Reset to default
38

Do not manually upgrade Apache.

Manual upgrading for security is unnecessary and probably harmful.

How Debian releases software

To see why this is, you must understand how Debian deals with packaging, versions, and security issues. Because Debian values stability over changes, the policy is to freeze the software versions in the packages of a stable release. This means that for a stable release very little changes, and once things work they should continue working for a long time.

But, what if a serious bug or security issue is discovered after release of a Debian stable version? These are fixed, in the software version provided with Debian stable. So if Debian stable ships with Apache 2.4.10, a security issue is found and fixed in 2.4.26, Debian will take this security fix, and apply it to 2.4.10, and distribute the fixed 2.4.10 to its users. This minimizes disruptions from version upgrades, but it makes version sniffing such as Tenable does meaningless.

Serious bugs are collected and fixed in point releases (the .9 in Debian 8.9) every few months. Security fixes are fixed immediately and provided through an update channel.

In general, as long as you run a supported Debian version, stick to stock Debian packages, and stay up to date on their security updates, you should be good.

Your Tenable report

To check if Debian stable is vulnerable for your issues, Tenable's "2.4.x < 2.4.27 multiple issues" is useless. We need to know exactly which security issues they are talking about. Luckily, every significant vulnerability is assigned a Common Vulnerability and Exposures (CVE) identifier, so we can talk easily about specific vulnerabilities.

For example, on this page for Tenable issue 101788 we can see that that issue is about vulnerabilities CVE-2017-9788 and CVE-2017-9789. We can search for these vulnerabilities on the Debian security tracker. If we do that, we can see that CVE-2017-9788 has the status "fixed" in or before version 2.4.10-10+deb8u11. Likewise, CVE-2017-9789 is fixed.

Tenable issue 10095 is about CVE-2017-3167, CVE-2017-3169, CVE-2017-7659, CVE-2017-7668, and CVE-2017-7679, all fixed.

So if you're on version 2.4.10-10+deb8u11, you should be safe from all these vulnerabilities! You can check this with dpkg -l apache2 (ensure your terminal is wide enough to show the full version number).

Staying up to date

So, how do you ensure you're up to date with these security updates?

First, you need to have the security repository in your /etc/apt/sources.list or /etc/apt/sources.list.d/*, something like this:

deb http://security.debian.org/ jessie/updates main

This is a normal part of any installation, you should not have to do anything special.

Next, you must ensure that you install updated packages. This is your responsibility; it is not done automatically. A simple but tedious way is to log in regularly and run

# apt-get update
# apt-get upgrade

Judging from the fact that you report your Debian version as 8.8 (we're at 8.9) and the ... and 48 not upgraded. from your post, you might want to do this soon.

To be notified of security updates, I higly recommend subscribing to the Debian security announcements mailinglist.

Another option is ensuring your server can send you emails, and installing a package like apticron, which emails you when packages on your system need updating. Basically, it regularly runs the apt-get update part, and pesters you to do the apt-get upgrade part.

Finally, you could install something like unattended-upgrades, which not only checks for updates, but automatically installs the updates without human intervention. Upgrading the packages automatically without human supervision carries some risk, so you need to decide for yourself if that is a good solution for you. I use it and I'm happy with it, but caveat updator.

Why upgrading yourself is harmful

In my second sentence, I said upgrading to the latest Apache version is probably harmful.

The reason for this is simple: if you follow Debian's version of Apache, and make a habit of installing the security updates, then you are in a good position, security-wise. Debians security team identifies and fixes security issues, and you can enjoy that work with minimal effort.

If, however, you install Apache 2.4.27+, say by downloading it from the Apache website and compiling it yourself, then the work of keeping up with security issues is fully yours. You need to track security issues, and go through the work of downloading/compiling/etc every time a problem is found.

It turns out this is a fair amount of work, and most people slack off. So they end up running their self-compiled version of Apache that becomes more and more vulnerable as issues are found. And so they end up a lot worse than if they simply had followed Debian's security updates. So yes, probably harmful.

That's not to say there's no place for compiling software yourself (or selectively taking packages from Debian testing or unstable), but in general, I recommend against it.

Duration of security updates

Debian doesn't maintain its releases forever. As a general rule, a Debian release recieves full security support for one year after it has been obsoleted by a newer release.

The release you're running, Debian 8 / jessie, is an obsoleted stable release (oldstable in Debian terms). It will receive full security support until May 2018, and long-term support until April 2020. I'm not entirely sure what the extent of this LTS support is.

The current Debian stable release is Debian 9 / stretch. Consider upgrading to Debian 9, which comes with newer versions of all software, and full security support for several years (likely until mid-2020). I recommend upgrading at a time that is convenient for you, but well before May 2018.

Closing remarks

Earlier, I wrote that Debian backports security fixes. This ended up being untenable for some software due to the high pace of development and high rate of security issues. These packages are the exception, and actually updated to a recent upstream version. Packages I know of this applies to are chromium (the browser), firefox, and nodejs.

Finally, this entire way of dealing with security updates is not unique to Debian; many distributions work like this, especially the ones that favour stability over new software.

Improve this answer
4
  • I hear the points you're making here but they'd be a lot more salient if comparing Stretch (stable) to Sid (unstable). Stretch gets most of the attention anyway and the same rules apply to security updates. Primarily the reason for oldstable is legacy support for all those lazy sys-admins or just those with internal software dependencies that haven't been updated. Could you demonstrate an appreciable difference in security using stable vs old stable?
    – jdwolf
    Nov 12, 2017 at 21:38
  • @jdwolf As far as I know, as long as oldstable is supported it receives as much security support as stable. I manage several dozen Debian machines, currently a mix of jessie and stretch, and I read all DSAs that apply to me. I never noticed a pattern of oldstable not getting enough attention. If you ever read DSAs, you can see that they tend to list the fixed version for both stable and oldstable (usually along with information on testing and unstable) in the same announcement.
    – marcelm
    Nov 12, 2017 at 21:46
  • I understand that but your post gives the impression updating from oldstable to stable is a bad thing.
    – jdwolf
    Nov 12, 2017 at 22:01
  • @jdwolf That's not my intention at all! In fact, I recommend stable over oldstable (assuming the situation permits it). From what part do you get that impression? I edited my post a bit; hopefully it's clearer now I don't advocate oldstable over stable.
    – marcelm
    Nov 13, 2017 at 11:45
6

Debian Jessie is still supported, and the security fixes provided in newer versions have been backported to the package available in Jessie (2.4.10-10+deb8u11, which means there have been 11 updates so far since the release of Jessie). All known, fixable vulnerabilities in Apache are fixed in the Jessie package; as long as you keep your installation up-to-date you should be safe. Future vulnerabilities will continue to be fixed in Jessie, as long as it remains supported.

It’s unlikely that a newer version will ever be backported to Jessie. As indicated above, you’re safe if you stay on Jessie, as long as it’s supported; if you need newer features not available in 2.4.10, you’ll need to upgrade to Debian 9.

Improve this answer
3

You are using Debian Jessie which is the old stable version of Debian. The latest version of Apache in Jessie is 2.4.10.

So you have two options, run apt dist-upgrade and migrate to Debian Stretch or you can wait for it be available in backports.

Improve this answer
2
  • And what us the apache version in debian stretch?
    – wawanopoulos
    Nov 12, 2017 at 16:01
  • @wawanopoulos 2.4.25-3+deb9u3
    – Vlastimil Burián
    Nov 12, 2017 at 17:04
3

OP has indicated in the comments that:

  • They are on Debian Jessie.
  • They want to upgrade Apache to deal with a security issue.

Debian Jessie is the current oldstable release (as of 2017-11-12). It should be receiving regular security updates from the Debian security team. Per the Debian Security FAQ:

The security team tries to support a stable distribution for about one year after the next stable distribution has been released, except when another stable distribution is released within this year. It is not possible to support three distributions; supporting two simultaneously is already difficult enough.

The current Debian stable is Stretch, which was released on 2017-06-17. Therefore, we expect the security team to support Jessie until approximately mid-2018. After that time, it will be in LTS through to the end of April 2020.

The bottom line: OP's system is still under support. OP can continue to upgrade the apache2 package as normal. If they do not have the security update already, they will receive it as soon as it has been backported and released. The version numbers may fail to match but this does not mean that the system is insecure.

According to this email, in September, Debian backported a fix to CVE-2017-9798 into Jessie. If this is the vulnerability OP is concerned about (and the jessie-security repo is in their sources.list file, as it should be), then it should already be fixed on their system (and they can confirm that by running apt show apache2 and checking that the version is 2.4.10-10+deb8u11). If not, then they should put the CVE number into the search box on Debian security's tracker and see what comes up. It should produce a page which describes the status of the vulnerability in various versions of Debian; OP will be looking for the "jessie (security)" line.

Improve this answer
1

The apache2 (2.4.10-10) is the latest version installed from debian repository through apt command , when a new version is available it will be upgraded automatically through apt.

unfortunately apache2 isn't available on jessie bacports .

You can install the latest version available on the apache wesite by compiling :

Compiling and Installing

Improve this answer
1
  • This is bad advice; if the OP compiles their own Apache, they will need to do that after every discovered security issue. It's far better to stay with the supported version of the distribution they're running.
    – marcelm
    Nov 12, 2017 at 21:23
1

You can view the avalible version in the your repository with:

root@server 20:54:59:~# apt-cache policy apache2
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .