Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #171019 > unrolled thread
| Started by | Daniel <daniel@zift.no> |
|---|---|
| First post | 2016-08-12 11:20 +0200 |
| Last post | 2016-08-12 15:30 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.user
problem with version numbering in packages openssl and libssl1.0.0? Daniel <daniel@zift.no> - 2016-08-12 11:20 +0200
Re: problem with version numbering in packages openssl and libssl1.0.0? Liam O'Toole <liam.p.otoole@gmail.com> - 2016-08-12 13:10 +0200
Re: problem with version numbering in packages openssl and libssl1.0.0? Daniel <daniel@zift.no> - 2016-08-12 15:20 +0200
Re: problem with version numbering in packages openssl and libssl1.0.0? Liam O'Toole <liam.p.otoole@gmail.com> - 2016-08-12 15:40 +0200
Re: problem with version numbering in packages openssl and libssl1.0.0? David Wright <deblis@lionunicorn.co.uk> - 2016-08-12 15:30 +0200
| From | Daniel <daniel@zift.no> |
|---|---|
| Date | 2016-08-12 11:20 +0200 |
| Subject | problem with version numbering in packages openssl and libssl1.0.0? |
| Message-ID | <s5gNc-8dR-5@gated-at.bofh.it> |
Is there a problem with the version numbering for the packages
"openssl" and "libssl1.0.0"? It seems I get the version from
jessie/main and that the version from jessie/updates/main is
ignored because of the extra letter in the version number.
Isn't 1.0.1k-3+deb8u5 the prefered version here? If so, then
I suspect lots of Debian stable users are stuck on a version
without the latest security patches, which I would consider
very bad.
Or is it just me being confused or have missed something?
- Daniel
---Paste
root:~# apt-get dist-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root:~#
root:~# apt-cache policy libssl1.0.0
libssl1.0.0:
Installed: 1.0.1t-1+deb8u2
Candidate: 1.0.1t-1+deb8u2
Version table:
*** 1.0.1t-1+deb8u2 0
500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages
100 /var/lib/dpkg/status
1.0.1k-3+deb8u5 0
500 http://security.debian.org/ jessie/updates/main amd64 Packages
root:~#
root:~# apt-cache policy openssl
openssl:
Installed: 1.0.1t-1+deb8u2
Candidate: 1.0.1t-1+deb8u2
Version table:
*** 1.0.1t-1+deb8u2 0
500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages
100 /var/lib/dpkg/status
1.0.1k-3+deb8u5 0
500 http://security.debian.org/ jessie/updates/main amd64 Packages
root:~#
---Paste ends
[toc] | [next] | [standalone]
| From | Liam O'Toole <liam.p.otoole@gmail.com> |
|---|---|
| Date | 2016-08-12 13:10 +0200 |
| Subject | Re: problem with version numbering in packages openssl and libssl1.0.0? |
| Message-ID | <s5ivD-R3-1@gated-at.bofh.it> |
| In reply to | #171019 |
On 2016-08-12, Daniel <daniel@zift.no> wrote: > Is there a problem with the version numbering for the packages > "openssl" and "libssl1.0.0"? It seems I get the version from > jessie/main and that the version from jessie/updates/main is > ignored because of the extra letter in the version number. > Isn't 1.0.1k-3+deb8u5 the prefered version here? If so, then > I suspect lots of Debian stable users are stuck on a version > without the latest security patches, which I would consider > very bad. > > Or is it just me being confused or have missed something? > > - Daniel > > ---Paste > > root:~# apt-get dist-upgrade > Reading package lists... Done > Building dependency tree > Reading state information... Done > Calculating upgrade... Done > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > root:~# > root:~# apt-cache policy libssl1.0.0 > libssl1.0.0: > Installed: 1.0.1t-1+deb8u2 > Candidate: 1.0.1t-1+deb8u2 > Version table: > *** 1.0.1t-1+deb8u2 0 > 500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages > 100 /var/lib/dpkg/status > 1.0.1k-3+deb8u5 0 > 500 http://security.debian.org/ jessie/updates/main amd64 Packages > root:~# > root:~# apt-cache policy openssl > openssl: > Installed: 1.0.1t-1+deb8u2 > Candidate: 1.0.1t-1+deb8u2 > Version table: > *** 1.0.1t-1+deb8u2 0 > 500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages > 100 /var/lib/dpkg/status > 1.0.1k-3+deb8u5 0 > 500 http://security.debian.org/ jessie/updates/main amd64 Packages > root:~# > > ---Paste ends Note the letters 't' and 'k' in the version strings. Alpha-numeric sorting makes 1.0.1t-1+deb8u2 the preferred version. -- Liam
[toc] | [prev] | [next] | [standalone]
| From | Daniel <daniel@zift.no> |
|---|---|
| Date | 2016-08-12 15:20 +0200 |
| Subject | Re: problem with version numbering in packages openssl and libssl1.0.0? |
| Message-ID | <s5kxs-26U-13@gated-at.bofh.it> |
| In reply to | #171022 |
On Fri, Aug 12, 2016 at 11:24:31AM +0100, Liam O'Toole wrote: > On 2016-08-12, Daniel <daniel@zift.no> wrote: > > Is there a problem with the version numbering for the packages > > "openssl" and "libssl1.0.0"? It seems I get the version from > > jessie/main and that the version from jessie/updates/main is > > ignored because of the extra letter in the version number. > > Isn't 1.0.1k-3+deb8u5 the prefered version here? If so, then > > I suspect lots of Debian stable users are stuck on a version > > without the latest security patches, which I would consider > > very bad. > > > > Or is it just me being confused or have missed something? > > --Snip > > root:~# apt-cache policy openssl > > openssl: > > Installed: 1.0.1t-1+deb8u2 > > Candidate: 1.0.1t-1+deb8u2 > > Version table: > > *** 1.0.1t-1+deb8u2 0 > > 500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages > > 100 /var/lib/dpkg/status > > 1.0.1k-3+deb8u5 0 > > 500 http://security.debian.org/ jessie/updates/main amd64 Packages > > root:~# > > > > ---Paste ends > > Note the letters 't' and 'k' in the version strings. Alpha-numeric > sorting makes 1.0.1t-1+deb8u2 the preferred version. > > -- > > Liam > I know. I just wondered if that was the intention. I would think that the one in jessie/updates/main is usually prefered over the ones from jessie/main - Daniel
[toc] | [prev] | [next] | [standalone]
| From | Liam O'Toole <liam.p.otoole@gmail.com> |
|---|---|
| Date | 2016-08-12 15:40 +0200 |
| Subject | Re: problem with version numbering in packages openssl and libssl1.0.0? |
| Message-ID | <s5kQO-2fY-13@gated-at.bofh.it> |
| In reply to | #171026 |
On 2016-08-12, Daniel <daniel@zift.no> wrote: > On Fri, Aug 12, 2016 at 11:24:31AM +0100, Liam O'Toole wrote: >> On 2016-08-12, Daniel <daniel@zift.no> wrote: >> > Is there a problem with the version numbering for the packages >> > "openssl" and "libssl1.0.0"? It seems I get the version from >> > jessie/main and that the version from jessie/updates/main is >> > ignored because of the extra letter in the version number. >> > Isn't 1.0.1k-3+deb8u5 the prefered version here? If so, then >> > I suspect lots of Debian stable users are stuck on a version >> > without the latest security patches, which I would consider >> > very bad. >> > >> > Or is it just me being confused or have missed something? >> > > --Snip >> > root:~# apt-cache policy openssl >> > openssl: >> > Installed: 1.0.1t-1+deb8u2 >> > Candidate: 1.0.1t-1+deb8u2 >> > Version table: >> > *** 1.0.1t-1+deb8u2 0 >> > 500 http://ftp.no.debian.org/debian/ jessie/main amd64 Packages >> > 100 /var/lib/dpkg/status >> > 1.0.1k-3+deb8u5 0 >> > 500 http://security.debian.org/ jessie/updates/main amd64 Packages >> > root:~# >> > >> > ---Paste ends >> >> Note the letters 't' and 'k' in the version strings. Alpha-numeric >> sorting makes 1.0.1t-1+deb8u2 the preferred version. >> > I know. I just wondered if that was the intention. I would think that > the one in jessie/updates/main is usually prefered over the ones from > jessie/main Ah, I misunderstood your question. Version 1.0.1t came with the last point release[1]; in that way the version in jessie/main leapfrogged that in jessie/updates/main. 1: https://www.debian.org/News/2016/20160604 -- Liam
[toc] | [prev] | [next] | [standalone]
| From | David Wright <deblis@lionunicorn.co.uk> |
|---|---|
| Date | 2016-08-12 15:30 +0200 |
| Subject | Re: problem with version numbering in packages openssl and libssl1.0.0? |
| Message-ID | <s5kH7-2ca-1@gated-at.bofh.it> |
| In reply to | #171019 |
On Fri 12 Aug 2016 at 11:04:31 (+0200), Daniel wrote:
> Is there a problem with the version numbering for the packages
> "openssl" and "libssl1.0.0"? It seems I get the version from
> jessie/main and that the version from jessie/updates/main is
> ignored because of the extra letter in the version number.
> Isn't 1.0.1k-3+deb8u5 the prefered version here? If so, then
> I suspect lots of Debian stable users are stuck on a version
> without the latest security patches, which I would consider
> very bad.
>
> Or is it just me being confused or have missed something?
Yes. But if you want to avoid tackling the Debian version system,
just look at the/any package's changelog and the versions/dates
within. Running jessie,
$ zcat /usr/share/doc/libssl1.0.0/changelog.Debian.gz | head -n 30
openssl (1.0.1t-1+deb8u2) jessie; urgency=medium
* add Update-S-MIME-certificates.patch to update expired certificates to
pass the test suite
-- Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Wed, 11 May 2016 23:22:52 +0200
openssl (1.0.1t-1+deb8u1) jessie; urgency=medium
[ Sebastian Andrzej Siewior ]
* Update to 1.0.1t stable release (drop applied patches and refresh existing
ones).
- Use alternate trust chains part of 1.0.1n (Closes: #774882).
- Use correct digest when exporting keying material (Closes: #807057)
- Fix CVE-2015-3197 (not affected, SSLv2 disabled)
- Fix CVE-2015-1793 (1.0.1n+ is affected and last upload was k)
-- Kurt Roeckx <kurt@roeckx.be> Fri, 06 May 2016 15:56:09 +0200
openssl (1.0.1k-3+deb8u5) jessie-security; urgency=medium
* Fix CVE-2016-2105
* Fix CVE-2016-2106
* Fix CVE-2016-2107
* Fix CVE-2016-2108
* Fix CVE-2016-2109
* Fix CVE-2016-2176
-- Kurt Roeckx <kurt@roeckx.be> Tue, 03 May 2016 18:44:21 +0200
$
Cheers,
David.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web