I have multiple cloud stacks that are running Ubuntu 14.04.2 and I need to remediate CVEs that I'm exposed to in the zlib
library (specifically zlib1g
and zlib1g-dev
. Eventually I need to migrate these systems to a more recent version of Ubuntu, however until I have resolved blockers to upgrading I need to mitigate existing CVEs.
- What is the best practices are for upgrading system packages?
- What should I be worried about breaking / how to test for functional regression?
What I'm currently testing is to add sources from more recent versions of Ubuntu (e.g. artful
):
sudo cp /etc/apt/sources.list /etc/apt/sources.list.d/artful.list
sudo vim /etc/apt/sources.list.d/artful.list # replace "trusty" with "zesty"
sudo apt-get update
Pin all packages to trusty
:
$ cat /etc/apt/preferences
Package: *
Pin: release n=trusty
Pin-Priority: 900
Package: *
Pin: release o=Ubuntu
Pin-Priority: -10
Then upgrade specific packages with:
apt-get install --only-upgrade <package> -t zesty
The package that I need to upgrade: zlib1g
/ zlib1g-dev
- CVE-2016-9840 (high)
- CVE-2016-9841 (critical)
- CVE-2016-9842 (high)
- CVE-2016-9843 (critical)
Upgrading system packages does not get me a version of zlib1g with the CVE's resolved. I need version >= 1:1.2.8.dfsg-4
closest is probably 1:1.2.11.dfsg-0ubuntu1
from zesty
. See:
$ dpkg -s zlib1g | grep Version:
Version: 1:1.2.8.dfsg-1ubuntu1
$ sudo apt-get update && apt-get upgrade
$ dpkg -s zlib1g | grep Version:
Version: 1:1.2.8.dfsg-1ubuntu1
Content of /etc/apt/sources.list
:
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://archive.ubuntu.com/ubuntu/ trusty main restricted
deb-src http://archive.ubuntu.com/ubuntu/ trusty main restricted
## Major bug fix updates produced after the final release of the
## distribution.
deb http://archive.ubuntu.com/ubuntu/ trusty-updates main restricted
deb-src http://archive.ubuntu.com/ubuntu/ trusty-updates main restricted
## Uncomment the following two lines to add software from the 'universe'
## repository.
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://archive.ubuntu.com/ubuntu/ trusty universe
deb-src http://archive.ubuntu.com/ubuntu/ trusty universe
deb http://archive.ubuntu.com/ubuntu/ trusty-updates universe
deb-src http://archive.ubuntu.com/ubuntu/ trusty-updates universe
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://archive.ubuntu.com/ubuntu/ trusty-backports main restricted
# deb-src http://archive.ubuntu.com/ubuntu/ trusty-backports main restricted
deb http://archive.ubuntu.com/ubuntu/ trusty-security main restricted
deb-src http://archive.ubuntu.com/ubuntu/ trusty-security main restricted
deb http://archive.ubuntu.com/ubuntu/ trusty-security universe
deb-src http://archive.ubuntu.com/ubuntu/ trusty-security universe
# deb http://archive.ubuntu.com/ubuntu/ trusty-security multiverse
# deb-src http://archive.ubuntu.com/ubuntu/ trusty-security multiverse
.2
in14.04.2
indicates you haven't upgraded your system in a long while! (I don't mean upgrading to a newer version of ubuntu, stay on 14.04 but upgrade the packages; you may also need to look at hwe to pull the next supported LTS kernel)zlib1g
with the fix isn't availble intrusty
ortrusty-updates
. I need version >=1:1.2.8.dfsg-4
but probably better to get1:1.2.11.dfsg-0ubuntu2
. I updated the question.sources.list
file, I'm using a docker container to test this, but comparing it to my production environment on AWS they seem to be using the same sources.zlib
package from a more recent Ubuntu version is going to be high-risk then I will try pushing back on this. However, I don't know how well that will be received. The CVE is being flagged as high severity by AWS Inspector and a security audit by a 3rd party is driving this. The CVEs have been fixed in more recent versions of zlib and upstream changes brought into more recent Ubuntu versions, but they haven't been ported back totrusty
it seems.