debian.org/security/2014/dsa-3032
It say's:
Zitat von Debian.orgFor the stable distribution (wheezy), this problem has been fixed in version 4.2+dfsg-0.1+deb7u1.
When you do
apt-get changelog bashyou'll pull a changelog from the packet. In this case, the maintainer is not providing a changelog via apt - but it shows the version number!
4.2+dfsg-0.1+deb7u1 - where the problem is fixed.
4.2+dfsg-0.1+deb7u1 - installed on my OMV 1.
So, maybe it has been installed without getting noticed by you. 
There are several other ways to find version numbers with
apt-show-versions,
aptitudeor
dpkg- use whatever is clever for you. 
Debian-Packages are pulled from Debian-Servers and are maintained by their community. So every update the do, you'll get... 
Thanks, I added the LTS repo and it's fine now. Now I need to figure out how to patch my old SPARC Lenny webserver, but that's not OMV's problem
As long as your system is not opened to the internet I would not fear such bugs. 
Greetings
David
Just for Reference:
How to add the LTS-Repos to Debian 6.
To check if you're wounded:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"If it says "Vulnerable" - you're...
As long as your system is not opened to the internet I would not fear such bugs.
Well, I believe the bug can be invoked via CGI so it's not necessarily required that the box be "open to the internet", if it exposes any web services it's potentially at risk. OMV being based on Debian means that some of us use it for a lot more than just local media
...and we got some Professionals (Business) here.
Thanks for the hints! I have added the lts sources to my list and updated bash along with some other programs.
Hope this will do it for now until I find the time to upgrade to wheezy...
Maybe it might be helpful for others to make this info more prominent or automatically provide this update?
They pushed an update two days ago, an another one today. The first patch didn't get rid of the bug, according to
They pushed an update two days ago, an another one today. The first patch didn't get rid of the bug, according to
ok, but how do we go about updating to that? apt-get upgrade doesnt seem to update bash.
You need to update the list first.
apt-get update, then
apt-get upgrade
See above - same way:
https://security-tracker.debian.org/tracker/CVE-2014-7169
Squeeze LTS: 4.1-3+deb6u2
Wheezy: 4.2+dfsg-0.1+deb7u3
And it's in the updates (see attached image).
I'm not seeing that update on my Sardaukar box. Am I missing something? I'm currently on 0.5.60.
You have to add the Debian-LTS-Repo: Debian bash vulnerability - patch incoming?
Just remember to add the repos in /etc/apt/sources.list.d/custom_name.list. The sources.list file is locked to prevent modification.
Just remember to add the repos in /etc/apt/sources.list.d/custom_name.list. The sources.list file is locked to prevent modification.
No need to create the file if you use the custom repos tab in omv-extras. Actually, sources.list isn't locked if your system is fully updated.
Though they lock that file in 0.5 to prevent people messing up with the updates.
Correct. Aaron locked the file. We discussed this a few days ago and decided to unlock it again because some people encountered problems while upgrading from 0.5 to 1.0
Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!