4

I am running Ubuntu LTS Server. Are there any concerns with security patching of universe packages? I mean am I in risk of running vulnerable system if having universe packages when compared to the alternative of running a similar Debian server?

2
  • -1 for close. This is a FAQ in my experience and a number of objective and useful answers are possible. May 5, 2015 at 17:32
  • @RobieBasak You're entitled to that opinion. I voted to close as too broad and my reasoning for that is that "Are there any concerns with security... of universe packages" and "Am I in risk" are two very different, extraordinarily broad questions. In the IT Security professional community, we say that there is no system that is not vulnerable to something, and that there are steps to protect and mitigate the risk of being exploited, however that's a practice that can't be summarized here. My answer is very general, but touches upon all points as such, while also touching on Universe security
    – Thomas Ward
    May 5, 2015 at 18:32

1 Answer 1

5

Even in Debian, there are many many packages that don't get regular security updates. From the Debian security channel on OFTC IRC:

The security team provides support for all packages, with the help of the package maintainers (and upstream developers).

From the general discussion, we can assume that major security breakages get their attention, but there is obviously a threshold for severity.

From the Debian Security FAQ for the question "How is security handled in Debian?":

Once the security team receives a notification of an incident, one or more members review it and consider its impact on the stable release of Debian (i.e. if it's vulnerable or not). If our system is vulnerable, we work on a fix for the problem. The package maintainer is contacted as well, if they didn't contact the security team already. Finally, the fix is tested and new packages are prepared, which are then compiled on all stable architectures and uploaded afterwards. After all of that is done, an advisory is published.

However, the consideration point is that the security team isn't going to be fluent in all packages, and will rely on the support from package maintainers and upstream devs as well to 'fix' problems.

Upon further discussion in the Debian Security IRC channel, it was said that my analysis here sums up the situation nicely:

The Debian security team provides support for all with the help of package maintainers and upstream, but they don't personally patch everything.
-- teward


Ubuntu is no different, except that the community supports 'universe'. The Universe packages are not actively maintained by the Ubuntu Security Team, and security fixes for those packages are community provided (with some exceptions, such as the nginx package which almost exclusively I provide patches for to the Ubuntu Security Team). While you are not guaranteed any updates for these packages, a lot of the popular ones will have enough attention to usually have someone working to try and patch security issues.

To specifically answer, though, you'd need to provide the package list(s) you're curious about, but not on this site as that becomes an open ended unending set of questions and answers.

To truly answer the question of 'vulnerable system' is impossible within the scope of this site though, because while there are 'safeguards' you can take to mitigate some of the nonpatched software due to the nature of those packages, analyzing your use cases and determining mitigation for each thing also goes outside the scope of this site and the ability to answer within the restrictions set forth here.

5
  • Thanks for answer. I am actually wondering if Ubuntu Security Team not patching universe makes you actually find more unpatched packages from Ubuntu when comparing to Debian. I am not sure, but I think that Debian security team patches all packages.
    – sampie
    May 5, 2015 at 18:33
  • 1
    @sampie I'm pretty certain the Debian Security team doesn't do any patching of software except critical components, and just lets maintainers know if they're not patched with something (observed this on nginx, znc, and some other packages). You will see this in every OS though, security teams put emphasis on core, critical components vs. others. I'll ask in their IRC channel, but i'm almost certain this is the case.
    – Thomas Ward
    May 5, 2015 at 18:35
  • @sampie from Debian Security's IRC, my assessment as follows is a good summary according to them, that this sums it up nicely: "The Debian security team provides support for all packages, with the help of package maintainers and upstream, but they don't personally patch everything." So you may still run into cases where things aren't patched in a timely manner. Major software and core security vulns (like OpenSSL) are expediently handled, but an obscure package might not.
    – Thomas Ward
    May 5, 2015 at 18:51
  • Thank you for taking a good look at this issue. So, basically much of security patching depends on package maintainers although Debian security team seems to have a big role when they are made aware of a problem in any package.
    – sampie
    May 5, 2015 at 19:47
  • @sampie Correct. In Ubuntu a similar policy is in place, except it's up to maintainers to handle the security update prep and the security team doesn't provide notice. With the exception of packages I watch like a hawk (of which I try and provide patches to the security team for updating software), maintainers or the community provide patches for those CVEs and issues to the Ubuntu Security Team, and they process it according to their policies.
    – Thomas Ward
    May 6, 2015 at 0:42

Not the answer you're looking for? Browse other questions tagged .