Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #246357 > unrolled thread

Debian DSA-5095-1 : linux - security update

Back to article view | Back to linux.debian.user

Contents

  Debian DSA-5095-1 : linux - security update Sona Das <sona.das@wearealef.com> - 2022-03-16 19:40 +0100
    Re: Debian DSA-5095-1 : linux - security update "Andrew M.A. Cater" <amacater@einval.com> - 2022-03-16 20:50 +0100
    Re: Debian DSA-5095-1 : linux - security update Ben Hutchings <ben@decadent.org.uk> - 2022-03-17 01:10 +0100
      Re: Debian DSA-5095-1 : linux - security update Sona Das <sona.das@wearealef.com> - 2022-03-17 15:20 +0100
        Re: Debian DSA-5095-1 : linux - security update Greg Wooledge <greg@wooledge.org> - 2022-03-17 15:30 +0100
        Re: Debian DSA-5095-1 : linux - security update Peter Wienemann <fossdev@posteo.de> - 2022-03-17 16:40 +0100
          Re: Debian DSA-5095-1 : linux - security update Cindy Sue Causey <butterflybytes@gmail.com> - 2022-03-17 17:40 +0100
        Re: Debian DSA-5095-1 : linux - security update Thorsten Glaser <tg@debian.org> - 2022-03-19 01:50 +0100

#246357 — Debian DSA-5095-1 : linux - security update

[Multipart message — attachments visible in raw view] — view raw

Hi Team,

We are having High level threat in our Debian systems detected by our vulnerability scanners 
Debian DSA-5095-1 : linux - security update

Debian DSA-4994-1 : bind9 - security update

We tried to upgrade our Debian systems using the Debian repo but the affected packages didn’t received the package upgrade which takes care of the vulnerability. Below packages are affected and are not getting upgraded:
linux-headers-5.10.0-10-amd64_5.10.84-1
libirs-export161_1:9.11.19+dfsg-2.1




Best regards,
Sona Das
--- 
+91 7021926734 / 9768458639


CONFIDENTIALITY. This email and any attachments are confidential to Alef Edge, and may also be privileged, except where the email states it can be disclosed. If this email is received in error, please do not disclose the contents to anyone, notify the sender by return email, and delete this email (and any attachments) from your system.


-- 


CONFIDENTIALITY. This email and any attachments are confidential to Alef 
Edge Inc., and may also be privileged, except where the email states it can 
be disclosed. If this email is received in error, please do not disclose 
the contents to anyone, notify the sender by return email, and delete this 
email (and any attachments) from your system.

[toc] | [next] | [standalone]

#246361

On Wed, Mar 16, 2022 at 11:46:02PM +0530, Sona Das wrote:
> Hi Team,
> 
> We are having High level threat in our Debian systems detected by our vulnerability scanners 
> Debian DSA-5095-1 : linux - security update
> 
> Debian DSA-4994-1 : bind9 - security update
> 
> We tried to upgrade our Debian systems using the Debian repo but the affected packages didn’t received the package upgrade which takes care of the vulnerability. Below packages are affected and are not getting upgraded:
> linux-headers-5.10.0-10-amd64_5.10.84-1
> libirs-export161_1:9.11.19+dfsg-2.1
> 
> 
[Cutting down the lists in cc]

Hi,

* What does your /etc/apt/sources.list look like?

https://wiki.debian.org/SourcesList provides good examples.

* Have you got any packages pinned?

Be aware that the sources.list changed slightly for Debian 11, as also
mentioned in the release notes for Debian 11.

All the very best, as ever,

Andy Cater
> 
> 
> Best regards,
> Sona Das
> --- 
> +91 7021926734 / 9768458639
> 
> 
> CONFIDENTIALITY. This email and any attachments are confidential to Alef Edge, and may also be privileged, except where the email states it can be disclosed. If this email is received in error, please do not disclose the contents to anyone, notify the sender by return email, and delete this email (and any attachments) from your system.
> 
> 
> -- 
> 
> 
> CONFIDENTIALITY. This email and any attachments are confidential to Alef 
> Edge Inc., and may also be privileged, except where the email states it can 
> be disclosed. If this email is received in error, please do not disclose 
> the contents to anyone, notify the sender by return email, and delete this 
> email (and any attachments) from your system.

[toc] | [prev] | [next] | [standalone]

#246366

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2022-03-16 at 23:46 +0530, Sona Das wrote:
> Hi Team,
> 
> We are having High level threat in our Debian systems detected by our vulnerability scanners 
> Debian DSA-5095-1 : linux - security update
> 
> Debian DSA-4994-1 : bind9 - security update
> 
> We tried to upgrade our Debian systems using the Debian repo but the affected packages didn’t received the package upgrade which takes care of the vulnerability. Below packages are affected and are not getting upgraded:
> linux-headers-5.10.0-10-amd64_5.10.84-1

This was replaced by linux-headers-5.10.0-11-amd64.  So long as you
install the metapackage linux-headers-amd64, replacements like this
should be upgraded automatically.

> libirs-export161_1:9.11.19+dfsg-2.1

This is the only version available in Debian.  It is built separately
from bind9 and is only used by the ISC DHCP server.

Ben.

-- 
Ben Hutchings
Make three consecutive correct guesses and you will be considered
an expert.

[toc] | [prev] | [next] | [standalone]

#246384

[Multipart message — attachments visible in raw view] — view raw

But whenever I tried to upgrade my linux-header it still remains on linux-headers-5.10.0-10 version, it doesn’t gets upgraded to the latest one.

As per the below url the security vulnerability for Debian 11 is resolved in version 5.10.103-1, but my "apt-get upgrade”  doesn’t upgrade the linux-headers to the latest fixed version

https://security-tracker.debian.org/tracker/CVE-2022-23222 <https://security-tracker.debian.org/tracker/CVE-2022-23222>

Im using the below repository urls in my sources.list to update my Debian system

deb http://deb.debian.org/debian/ bullseye main
deb-src http://deb.debian.org/debian/ bullseye main
deb http://deb.debian.org/debian/ bullseye-updates main contrib
deb-src http://deb.debian.org/debian/ bullseye-updates main contrib
deb http://security.debian.org/debian-security bullseye-security main contrib
deb-src http://security.debian.org/debian-security bullseye-security main contrib

> On 17-Mar-2022, at 5:38 AM, Ben Hutchings <ben@decadent.org.uk> wrote:
> 
> On Wed, 2022-03-16 at 23:46 +0530, Sona Das wrote:
>> Hi Team,
>> 
>> We are having High level threat in our Debian systems detected by our vulnerability scanners 
>> Debian DSA-5095-1 : linux - security update
>> 
>> Debian DSA-4994-1 : bind9 - security update
>> 
>> We tried to upgrade our Debian systems using the Debian repo but the affected packages didn’t received the package upgrade which takes care of the vulnerability. Below packages are affected and are not getting upgraded:
>> linux-headers-5.10.0-10-amd64_5.10.84-1
> 
> This was replaced by linux-headers-5.10.0-11-amd64.  So long as you
> install the metapackage linux-headers-amd64, replacements like this
> should be upgraded automatically.
> 
>> libirs-export161_1:9.11.19+dfsg-2.1
> 
> This is the only version available in Debian.  It is built separately
> from bind9 and is only used by the ISC DHCP server.
> 
> Ben.
> 
> -- 
> Ben Hutchings
> Make three consecutive correct guesses and you will be considered
> an expert.


Best regards,
Sona Das
--- 
+91 7021926734 / 9768458639


CONFIDENTIALITY. This email and any attachments are confidential to Alef Edge, and may also be privileged, except where the email states it can be disclosed. If this email is received in error, please do not disclose the contents to anyone, notify the sender by return email, and delete this email (and any attachments) from your system.


-- 


CONFIDENTIALITY. This email and any attachments are confidential to Alef 
Edge Inc., and may also be privileged, except where the email states it can 
be disclosed. If this email is received in error, please do not disclose 
the contents to anyone, notify the sender by return email, and delete this 
email (and any attachments) from your system.

[toc] | [prev] | [next] | [standalone]

#246385

On Thu, Mar 17, 2022 at 07:32:27PM +0530, Sona Das wrote:
> But whenever I tried to upgrade my linux-header it still remains on linux-headers-5.10.0-10 version, it doesn’t gets upgraded to the latest one.
> 
> As per the below url the security vulnerability for Debian 11 is resolved in version 5.10.103-1, but my "apt-get upgrade”  doesn’t upgrade the linux-headers to the latest fixed version

First, you need to run "apt-get update" to refresh your cached copy
of the available package lists.

Second, you need to run "apt-get --with-new-pkgs upgrade" (or simply
"apt-get dist-upgrade" if you prefer that) in order to download new
packages that are dependencies of existing packages.

If you only use "apt-get upgrade", you will never bring in any new
kernels or kernel headers, because each ABI bump creates a whole new
package with a whole new name.  Similarly, any security update that
has new library dependencies will be blocked.  The packages that are
built from the BIND source tend to fall into that group quite often.

Another alternative, if you don't like the two I've already given, would
be to use "apt upgrade".  This uses the --with-new-pkgs option by default.
However, it also has some REALLY negative behaviors (deletes package files
from /var/cache/apt/archives/ afterward, and uses yellow text that is
extremely hard to read on a white background, and cannot be changed), so
you might not want this one.

[toc] | [prev] | [next] | [standalone]

#246388

Hi Sona,

On 17.03.22 15:02, Sona Das wrote:
> But whenever I tried to upgrade my linux-header it still remains on 
> linux-headers-5.10.0-10 version, it doesn’t gets upgraded to the latest one.

have you verified that the metapackage linux-headers-amd64 is installed 
on your system - as suggested by Ben (see below)?

>> On 17-Mar-2022, at 5:38 AM, Ben Hutchings <ben@decadent.org.uk 
>> <mailto:ben@decadent.org.uk>> wrote:
>> So long as you
>> install the metapackage linux-headers-amd64, replacements like this
>> should be upgraded automatically.

You can check its status using

dpkg -l linux-headers-amd64

Best regards,

Peter

[toc] | [prev] | [next] | [standalone]

#246389

On 3/17/22, Peter Wienemann <fossdev@posteo.de> wrote:
>
> You can check its status using
>
> dpkg -l linux-headers-amd64


That has interesting feedback. I've been using the following for a
slightly different trek toward a similar end (includes what mine says
right now):

$ apt-cache policy linux-headers-amd64
linux-headers-amd64:
  Installed: 5.16.12-1
  Candidate: 5.16.12-1
  Version table:
     5.17~rc8-1~exp1 1
          1 http://deb.debian.org/debian experimental/main amd64 Packages
 *** 5.16.12-1 500
        500 http://deb.debian.org/debian bookworm/main amd64 Packages
        100 /var/lib/dpkg/status

Being able to compare the Installed versus Candidate fields has been
cognitively friendly as a checkpoint for my style of user generated...
issues. :D

For newer users, the various versions under "Version table" reflect
that I use "bookworm bookworm-updates experimental" as the "Suites" in
my debian.sources** file. Version table's nice to see because that
data is a constant reminder to think ahead about developing toward the
Future.

IMPORTANT: It's highly recommended that we avoid experimental. It's
just that that's the only place I can find wicd-curses. Thank you for
wicd-curses still being there, Developers! That's a priceless package.
:)

** debian-sources goes under sources.list.d as an alternative to
sources.list. It was a momentarily seen talking point under something
like "man sources.list" at some point in my own personal Debian
adventures.

Cindy :)
-- 
Talking Rock, Pickens County, Georgia, USA
* runs with birdseed *

[toc] | [prev] | [next] | [standalone]

#246436

>"apt-get upgrade”  doesn’t upgrade the linux-headers to the latest
>fixed version

You need “apt-get upgrade --with-new-pkgs” at the very least to keep
a stable system up-to-date. I use “apt-get --purge dist-upgrade” myself
while keeping an eye on what packages apt wants to remove with that.

bye,
//mirabilos
-- 
When he found out that the m68k port was in a pretty bad shape, he did
not, like many before him, shrug and move on; instead, he took it upon
himself to start compiling things, just so he could compile his shell.
How's that for dedication. -- Wouter, about my Debian/m68k revival

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web