5 ms·

CVE-2016-6213 was reported three years ago by OpenVZ developer

43 points by ligurio 10y ago

gnoway 10y ago
It was actually two years ago, if someone wants to correct the title. Edit: I clearly can't read. Upvoted you both, thanks.
- laurencei 10y ago
  No - the comment text says "I've reported this problem two years ago" - but the date of the report is 20th Jun 2013 - which is definitely 3 years ago
- mgraczyk 10y ago
  The email was sent in June 2013, three years ago. The author mistyped the year in his comment on the bug report.
mrmondo 10y ago
Interesting, my 2c: You shouldn't be using OpenVZ in 2016 regardless, I know lots of budget web hosting providers still provide it as an option but really IMO they should have moved on around 2-3 years ago.
- chii 10y ago
  why not?
- jamescun 10y ago
  May I ask why not? I feel OpenVZ gets a bad rap simply because of the "pop up" VPS providers who oversell and under-provision. It is a mature, maintained containerisation system. Yes it still requires kernel patches (created before Linux had namespaces/cgroups etc) but the team is actively working on merging missing functionality upstream and adapting OpenVZ tools to support things like namespaces and cgroups.
  - Fizzadar 10y ago
    This. I've used OpenVZ for internal containerisation (before the whole Docker explosion) without any issues. It's fast and provides what feels like a fully blown virtual machine. Yes, it's a bit out of date these days (being on Linux 2.6), but it's still an incredibly useful tool, and I see no reason to stop using it.
    - smcleod 10y ago
      Kernel 2.6 is more than a bit out of date, ok maybe kernel 3.18 is a bit out of date but kernel 2.x (and really 3.x) is /really/ out of date.
      - ligurio 10y ago
        Actually, OpenVZ based on RHEL7 (3.10+) kernel is available. https://lists.openvz.org/pipermail/announce/2016-July/000664.html https://lists.openvz.org/pipermail/announce/2016-July/000664...
      - kolyshkin 10y ago
        Again, please, don't judge kernel by its version number. The kernel that RHEL6 comes with has version of 2.6.32, but it's as far from "vanilla" 2.6.32 as Chicago from Seattle. It has tons of patches (with OpenVZ patchet being only about 10% of it). There's a somewhat old comparison about RHEL5 patch set that you can see here: http://openvz.livejournal.com/27592.html http://openvz.livejournal.com/27592.html
  - mrmondo 10y ago
    Well for starters I believe it still relies on Kernel 2.6, I think they forked the kernel then never kept it up to date, I could be wrong about this but it certainly was the case up until recently at least. Looking at OpenVZ's website it also seems to only official support RHEL 5/6 as stable host options which were behind their time at point of release and now in 2016 really are very, _very_ old dogs. LXC and Docker, especially when combined with a virtualisation layer and SELinux are modern, stable, well maintained options that are not only easy to configure and manage but do not require custom kernel patches etc...
- ligurio 10y ago
  Really? OpenVZ still has some advantages to compare with other virtualization solutions https://openvz.org/Comparison https://openvz.org/Comparison
  - mrmondo 10y ago
    Thats not even close to up to date and is incorrect. They're only just moving from their 2009 Kernel fork to a fork of Kernel 3.10 which was released in 2013... Edit: In fact, on second inspection, a lot of the items in that table are either wrong or straight out lies (although I'm assuming the former). I'd hate to think what the community around the product is like but I can only assume they live in a bubble similar to those in the Drupal community that thinks for whatever reason that the product they're using is the one and only / best solution rather than truly evaluating the best tool for the job, as far as I can see it unless that page you linked to truly isn't maintained thats the only way you could end up with that quality of information / misinformation available. Edit2: Formatting

43 points by ligurio 10y ago

It was actually two years ago, if someone wants to correct the title. Edit: I clearly can't read. Upvoted you both, thanks.

laurencei 10y ago
No - the comment text says "I've reported this problem two years ago" - but the date of the report is 20th Jun 2013 - which is definitely 3 years ago
mgraczyk 10y ago
The email was sent in June 2013, three years ago. The author mistyped the year in his comment on the bug report.

mrmondo 10y ago

Interesting, my 2c: You shouldn't be using OpenVZ in 2016 regardless, I know lots of budget web hosting providers still provide it as an option but really IMO they should have moved on around 2-3 years ago.

chii 10y ago
why not?
jamescun 10y ago
May I ask why not? I feel OpenVZ gets a bad rap simply because of the "pop up" VPS providers who oversell and under-provision. It is a mature, maintained containerisation system. Yes it still requires kernel patches (created before Linux had namespaces/cgroups etc) but the team is actively working on merging missing functionality upstream and adapting OpenVZ tools to support things like namespaces and cgroups.
- Fizzadar 10y ago
  This. I've used OpenVZ for internal containerisation (before the whole Docker explosion) without any issues. It's fast and provides what feels like a fully blown virtual machine. Yes, it's a bit out of date these days (being on Linux 2.6), but it's still an incredibly useful tool, and I see no reason to stop using it.
  - smcleod 10y ago
    Kernel 2.6 is more than a bit out of date, ok maybe kernel 3.18 is a bit out of date but kernel 2.x (and really 3.x) is /really/ out of date.
    - ligurio 10y ago
      Actually, OpenVZ based on RHEL7 (3.10+) kernel is available. https://lists.openvz.org/pipermail/announce/2016-July/000664.html https://lists.openvz.org/pipermail/announce/2016-July/000664...
    - kolyshkin 10y ago
      Again, please, don't judge kernel by its version number. The kernel that RHEL6 comes with has version of 2.6.32, but it's as far from "vanilla" 2.6.32 as Chicago from Seattle. It has tons of patches (with OpenVZ patchet being only about 10% of it). There's a somewhat old comparison about RHEL5 patch set that you can see here: http://openvz.livejournal.com/27592.html http://openvz.livejournal.com/27592.html
- mrmondo 10y ago
  Well for starters I believe it still relies on Kernel 2.6, I think they forked the kernel then never kept it up to date, I could be wrong about this but it certainly was the case up until recently at least. Looking at OpenVZ's website it also seems to only official support RHEL 5/6 as stable host options which were behind their time at point of release and now in 2016 really are very, _very_ old dogs. LXC and Docker, especially when combined with a virtualisation layer and SELinux are modern, stable, well maintained options that are not only easy to configure and manage but do not require custom kernel patches etc...
ligurio 10y ago
Really? OpenVZ still has some advantages to compare with other virtualization solutions https://openvz.org/Comparison https://openvz.org/Comparison
- mrmondo 10y ago
  Thats not even close to up to date and is incorrect. They're only just moving from their 2009 Kernel fork to a fork of Kernel 3.10 which was released in 2013... Edit: In fact, on second inspection, a lot of the items in that table are either wrong or straight out lies (although I'm assuming the former). I'd hate to think what the community around the product is like but I can only assume they live in a bubble similar to those in the Drupal community that thinks for whatever reason that the product they're using is the one and only / best solution rather than truly evaluating the best tool for the job, as far as I can see it unless that page you linked to truly isn't maintained thats the only way you could end up with that quality of information / misinformation available. Edit2: Formatting