I just want to take the opportunity to state that, being a Linux user but not any sort of serious sysadmin, navigating all this information is very confusing. T

I just want to take the opportunity to state that, being a Linux user but not any sort of serious sysadmin, navigating all this information is very confusing. This is an old bug report? And yet Ubuntu released a patch this morning? Why didn't I get a patch on Debian? I can see on ubuntu's bash page on launchpad what bugs were fixed in the most recent version, but which vulnerabilities were fixed in previous versions? Exactly what is a given distro still vulnerable to, right now? Looking at the dates posted, why does it look like there is such a long timeline between finding the bug, fixing it, and having it show up in the distro? I have answers to some of the above questions, but I'm restating them rhetorically to make the point that this stuff should be a lot more straightforward. I think this info should be available in a much more straightforward manner by the distros.