From: Alex Butcher, ISC/ISYS (Alex.Butcherbristol.ac.uk)
Date: Tue Aug 24 2004 - 09:55:07 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

--On 22 August 2004 23:02 -0700 David Benfell <benfellparts-unknown.org>
wrote:

> On Sat, 21 Aug 2004 23:51:47 -0500, Gabriel Orozco wrote:
>>
>> I know there are other, newer apache versions, but SuSE doesn't have
>> them. I disabled apache until the client authorizes the fix proposed
>> (upgrade from sources).
>>
> SuSE, and other distributors, commonly preserve the version number of
> software even as they patch the versions they offer to fix
> vulnerabilities. It's a headache because it means you have to look at
> their README files and other documentation to see if they've fixed the
> vulnerabilities you're looking for.
>
> But apparently, it avoids breaking their package management systems.

This is because they backport the security fixes to older versions. This
means that you can have more confidence that applying the updates won't
break other functionality that you're relying upon. So it's not so much
avoiding breaking their package management systems, as it is avoiding
having to ship new versions of packages that depend upon the updated
packages, and in turn breaking things all over the place.

<http://www.redhat.com/advice/speaks_backport.html>

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]