3 ms·

Just did an update on my Linode and one of the updates was replace bash 4.1-2ubuntu3 So seems like it's there now.

by teach 12y ago

traviscj 12y ago
Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.
- teach 12y ago
  Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers. I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?
  - aaronem 12y ago
    It probably ensures that you get the Linode-customized flavors of packages where such exist, so that, for example, you don't inadvertently upgrade your kernel to a build without the ability to mount Linode disks.
    - iancarroll 12y ago
      It's also meant to help you and Linlde save bandwidth!
    - crylon 12y ago
      Linode can't modify packages; they're signed by the upstream distro. (Unless Linode added a key of their own to your apt keychain (apt-key list), but I've never seen that.)
steveklabnik 12y ago
https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 seems to be at least one version of the fix, I'm unsure about LTS and other releases.
- sp332 12y ago
  http://www.ubuntu.com/usn/usn-2362-1/ http://www.ubuntu.com/usn/usn-2362-1/ Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1 Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2 Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1 For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after 9 months. There must be tons of boxes running 13.10, it's not even a year old yet.
  - bphogan 12y ago
    It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.
    - deleted 12y ago
      [deleted]
  - merlinmike 12y ago
    For 13.10 do this, selecting correct architecture: ---------------------------------------------------------- amd64 wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb ---------------------------------------------------------- i386 wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb

Just did an update on my Linode and one of the updates was replace bash 4.1-2ubuntu3 So seems like it's there now.

by teach 12y ago

Just did an update on my Linode and one of the updates was replace bash 4.1-2ubuntu3 So seems like it's there now.

traviscj 12y ago

Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.

teach 12y ago
Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers. I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?
- aaronem 12y ago
  It probably ensures that you get the Linode-customized flavors of packages where such exist, so that, for example, you don't inadvertently upgrade your kernel to a build without the ability to mount Linode disks.
  - iancarroll 12y ago
    It's also meant to help you and Linlde save bandwidth!
  - crylon 12y ago
    Linode can't modify packages; they're signed by the upstream distro. (Unless Linode added a key of their own to your apt keychain (apt-key list), but I've never seen that.)

steveklabnik 12y ago

https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 seems to be at least one version of the fix, I'm unsure about LTS and other releases.

sp332 12y ago
http://www.ubuntu.com/usn/usn-2362-1/ http://www.ubuntu.com/usn/usn-2362-1/ Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1 Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2 Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1 For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after 9 months. There must be tons of boxes running 13.10, it's not even a year old yet.
- bphogan 12y ago
  It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.
  - deleted 12y ago
    [deleted]
- merlinmike 12y ago
  For 13.10 do this, selecting correct architecture: ---------------------------------------------------------- amd64 wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb ---------------------------------------------------------- i386 wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb