2

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2
gives me version 2.4.18-2ubuntu3.9.

How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/security/vulnerabilities_24.html ?

I found the following sites:

1) https://usn.ubuntu.com/releases/ubuntu-16.04-lts/

Nothing here tells me anything about 2ubuntu3.9

2) https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.9

Nothing here tells me if 2ubuntu3.9 is the latest. It only tells me it was published on 2018-07-04. However latest "moderate" CVE on the apache page above is CVE-2018-8011 which is marked as "Update Released: 15th July 2018", so can I assume that this has not been patched yet on my version? Is there a 2ubuntu4.0 where it has been patched? When will it be released?

3) https://people.canonical.com/~ubuntu-security/cve/universe.html

Cant find any of the CVE from the apache page here. For example, CVE-2017-9789 is not in the list.


Question: Is there any way I can easily see which CVE my Apache 2.4.18-2ubuntu3.9 is vulnerable to?

  • 1
    Fantastic question! I also waste a fair amount of time asking questions like "Is that the vanilla Thing 1.2.3, or the Red Hat security-fixes-backported Thing 1.2.3"? I would love to know how Canonical handles this. – Mike Ounsworth Nov 28 '18 at 2:50
3

How do i know that 2ubuntu3.9 has the latest security patches

This is not a simple. Not all vulnerabilities listed on the Apache security page are relevant for the version shipped with Ubuntu. Ubuntu ships version 2.4.18 with backported patches they consider relevant.

The starting point to look what is fixed would be the Changelog and compare it with the list of bugs published by Apache.

But, that a CVE is not found in the Changelog does not mean that the version shipped is vulnerable against this. For example CVE-2018-8011 is considered to only affect Apache 2.4.33 and not the version 2.4.18 shipped with xenial. Similar the information on CVE-2018-1333 and CVE-2018-11763 say that the specific code where the vulnerability is not included in the version shipped with xenial ("not-affected (code not built)").

Thus, in order to know if a specific vulnerability is still a problem with the shipped version you need to dig through the Changelog and if you don't find the CVE there you need to check why it was not fixed, i.e. likely because it did not affect the version as shipped.

How do i know if my ubuntu apache version is secure?

The basic idea of this question is kind of wrong. That some software is not vulnerable to known CVE does not mean it is secure. If new vulnerabilities get discovered software does not magically gets insecure until the CVE gets fixed: it was insecure before but the newly detected problems were not widely known yet.

There are several factors to look at in order to determine if a software is sufficiently secure for a specific purpose. One is probably the track record of the software: software which is widely used but had only low severity issues in the past is probably more trustworthy compared to software which had lots of serious issues in the past, even though all known issues seem to be fixed know. For example I would definitely not trust Flash even after the latest security patch but just expect that the next issue pops up within a few weeks (it usually does) and that attackers know and already use issues not yet published.

To keep the risk low (and managed) it is also relevant what impact security issues in the software might cause. Limiting potential impact by using the software only for unimportant stuff might limit the risk as does mitigating potential problems by running the software with low privileges, monitoring suspicious activity etc.

1

One option is to look at launchpad under Bugs->CVE https://bugs.launchpad.net/ubuntu/+source/apache2/+bugs?field.has_cve=on

These are the bugs we know that affect that version of Apache the way it was built by Canonical.

But as Steffen Ulrich has detailed in his answer above there is a balance of issues with code, deployment and then software on running on top of the package.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.