0

How do i get the newest version on Ubuntu 18.04 (Longterm Version only!) for the apache2 package? (Please let me know if they apply the security patches from the newer versions backwards and i just missed this)

My question comes from the security scan we have executed on our servers. We are using Docker containers to run our application on an Ubuntu 18.04 Apache2 "Container".

Now according to https://packages.ubuntu.com/search?keywords=apache2 there is version 2.4.38 available, the security scan also shows that the version we are using 2.4.29-1 has a security issue.

We have found another repo https://launchpad.net/~ondrej/+archive/ubuntu/apache2 which has even a 2.4.39 available but this is not an official repo from Canonical.

  • That is one of the issues of using Docker....managing OS updates. – Rui F Ribeiro Apr 28 at 20:54
  • @RuiFRibeiro well this doesn't have to do anything with docker, if you would install it like this on a raw machine we would have the same effect – Oliver Apr 28 at 20:55
  • You are the one saying you use Docker, and we do not know how the Docker image is built. Normally updating the OS does not update Docker binaries automagically. But we might wait for someone more used to Docker to chirp in. – Rui F Ribeiro Apr 28 at 20:57
  • @RuiFRibeiro check the Link on the Repo page which i've attached the official Repository shows that lts doesnt have the newest version, the question is there do they apply the security patches only in the new versions or do we need to use the short term ubuntu versions in order to stay ahead of the hackers – Oliver Apr 28 at 20:59
0

If your container really is using Ubuntu 18.04 and has version 2.4.29-1 then it’s not up-to-date and is vulnerable.

Ubuntu, like all distributions, receives security updates for as long as it’s supported. The apache2 package for 18.04 is currently at version 2.4.29-1ubuntu4.6, and you can see the list of security issues fixed in the latest upload in its changelog. The full changelog lists all the issues fixed, including previous releases.

Ensuring your container is based on a supported release (it is) and is kept up-to-date (it isn’t) will keep you as safe as possible using a pre-packaged distribution.

  • Thanks that really answered my question, i was totally not sure if i needed to maybe even upgrade to be "safe" security wise, i will just ensure the container patches itself every few hours – Oliver May 1 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.