0

We are using Docker containers to run our application on an Ubuntu 18.04 Apache2 "Container".

According to https://packages.ubuntu.com/search?keywords=apache2 there is version 2.4.38 available, the security scan also shows that the version we are using 2.4.29-1 has a security issue.

We have found another repo https://launchpad.net/~ondrej/+archive/ubuntu/apache2 which has even a 2.4.39 available but this is not an official repo from Canonical.

How do i get the newest version on Ubuntu 18.04 (Longterm Version only) for the apache2 package? (Please let me know if they apply the security updates from the newer versions backwards and i just missed this)

4
  • That is one of the issues of using Docker....managing OS updates. Commented Apr 28, 2019 at 20:54
  • @RuiFRibeiro well this doesn't have to do anything with docker, if you would install it like this on a raw machine we would have the same effect
    – Oliver
    Commented Apr 28, 2019 at 20:55
  • You are the one saying you use Docker, and we do not know how the Docker image is built. Normally updating the OS does not update Docker binaries automagically. But we might wait for someone more used to Docker to chirp in. Commented Apr 28, 2019 at 20:57
  • @RuiFRibeiro check the Link on the Repo page which i've attached the official Repository shows that lts doesnt have the newest version, the question is there do they apply the security patches only in the new versions or do we need to use the short term ubuntu versions in order to stay ahead of the hackers
    – Oliver
    Commented Apr 28, 2019 at 20:59

1 Answer 1

1

If your container really is using Ubuntu 18.04 and has version 2.4.29-1 then it’s not up-to-date and is vulnerable.

Ubuntu, like all distributions, receives security updates for as long as it’s supported. The apache2 package for 18.04 is currently at version 2.4.29-1ubuntu4.6, and you can see the list of security issues fixed in the latest upload in its changelog. The full changelog lists all the issues fixed, including previous releases.

Ensuring your container is based on a supported release (it is) and is kept up-to-date (it isn’t) will keep you as safe as possible using a pre-packaged distribution.

1
  • Thanks that really answered my question, i was totally not sure if i needed to maybe even upgrade to be "safe" security wise, i will just ensure the container patches itself every few hours
    – Oliver
    Commented May 1, 2019 at 10:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .