We need to know exactly which security issues they are talking about. To check if Debian stable is vulnerable for your issues, Tenable's "2.4.x < 2.4.27 multiple issues" is useless. In general, as long as you run a supported Debian version, stick to stock Debian packages, and stay up to date on their security updates, you should be good. Security fixes are fixed immediately and provided through an update channel. Serious bugs are collected and fixed in point releases (the. This minimizes disruptions from version upgrades, but it makes version sniffing such as Tenable does meaningless. So if Debian stable ships with Apache 2.4.10, a security issue is found and fixed in 2.4.26, Debian will take this security fix, and apply it to 2.4.10, and distribute the fixed 2.4.10 to its users. This means that for a stable release very little changes, and once things work they should continue working for a long time.īut, what if a serious bug or security issue is discovered after release of a Debian stable version? These are fixed, in the software version provided with Debian stable.
Because Debian values stability over changes, the policy is to freeze the software versions in the packages of a stable release. To see why this is, you must understand how Debian deals with packaging, versions, and security issues. Manual upgrading for security is unnecessary and probably harmful.
0 kommentar(er)
