1

The current version of Apache for Ubuntu 18.0.4 is Apache 2.4.29 which is vulnerable to CVE-2018-1302. And since we are doing this under a PCI site, I need to get the vulnerability fixed ASAP.

I am considering building from source. But the issue is, I do not want to be stuck on the version built from source. So my question is, if I build from Apache 2.4.33 (which fixes the vulnerability), will apt-get update to a newer version once available? Is there anyway to tell when the official version from repo is expected to be released? I have been watching this site, but it does not give a ton of detail.

Thanks for your help!

Improve this question
3
  • It is classified as "Low risk".
    – MatsK
    Jun 8, 2018 at 14:50
  • 3
    You can build from source and monitor the site you mentioned till a fixed is released. Then you can return to normal operation through apt.
    – Pilot6
    Jun 8, 2018 at 14:56
  • @MatsK Doesn't matter. Auditor says it is a fail and he is the one that signs the line, not me. Trust me.. I agree with you.
    – alexander7567
    Jun 8, 2018 at 15:17

1 Answer 1

Reset to default
3

APT only see what is in the APT database.

If you install from source APT will not be aware of that and it will NOT be upgraded via APT!

Improve this answer
2
  • Just to clarify, installing from source is not a problem, but remove the Apache installed via APT first so you don't have conflicts.
    – MatsK
    Jun 8, 2018 at 15:25
  • Thanks - I'm not sure if I will go down this route though. Considering it will complicate things down the road when it comes to updates, plus I got to thinking I would also have to build each dependency Apache module as well. I suppose I will just hope and wait for an official release. I just wish I had some kind of a timeline or more a a way to view progress.
    – alexander7567
    Jun 8, 2018 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .