2

After all the buzz about CVE-2017-9445 it seems unclear to me which versions are really affected and need patching and which not?

Their own CVE issue states that Ubuntu 14.04 to the latest upstream release are affected by this, but only 16.10 and 17.04 have been receiving patches.

On the other hand in their disclosure they state that only Ubuntu 16.10 and 17.04 are affected.

Is Ubuntu (14.04.X and) 16.04.X now affected or not?

Also if so, after applying the update, is a full system reboot needed to apply the patch to systemd or can this be done on a live system?

1

1 Answer 1

2

The first link from you clearly says (contrary to your claims) that 14.04 and 15.04 are not affected, that patches for 16.10 and 17.04 have been released and that patches for 16.04 are needed.

It also says in the notes that the affected systemd-resolve is not used in 16.04 (Xenial) by default and will only be started is the user executes it - but this should at most affect the specific user and not the system. That's why patches for 16.04 are not that critical as they were for 16.10 and 17.04 where systemd-resolve is run by default.

5
  • You are correct about 14.04 but for 16.04 it says: Ubuntu 16.04 LTS (Xenial Xerus): needed
    – Bent
    Jul 1, 2017 at 8:57
  • @Flatron: I'm not sure how I should interpret your comment. You are just stating the same what I've said in my answer. To cite myself: "...patches for 16.04 are needed.". And I even explained why patches for 16.04 are less critical compared to 16.10 and 17.04. Jul 1, 2017 at 9:00
  • Oh dear, my bad. I see. Thank you for your answer.
    – Bent
    Jul 1, 2017 at 9:02
  • Would the average Ubuntu 16.04 user have any reason for executing/enabling systemd-resolve themselves?
    – raphael
    Jul 8, 2017 at 19:38
  • 1
    @raphael: I don't know what you consider the average Ubuntu user. But, considering that most users never do DNS lookups at the terminal or use nslookup or dig for this I think that most users will never explicitly invoke systemd-resolve. Jul 8, 2017 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .