<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>You won't see an update to 2.4.28 I bet. Instead, you'll see a
patched version of the package uploaded which contains the fix for
the CVE - this is typically what is done to update packages in
older releases for security fixes, by the Security Team.<br>
</p>
<p>Refer to the CVE tracker -
<a class="moz-txt-link-freetext" href="https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9798.html">https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9798.html</a>
- this details what versions are fixed, which are pending upload,
etc. - normally we (that is, Ubuntu and the Security Team, of
which I am not a part) don't upgrade Apache in all releases to a
newer version; we patch them instead.</p>
<p>Thomas<br>
Ubuntu Server Team Member<br>
Launchpad: ~teward<br>
</p>
<br>
<div class="moz-cite-prefix">On 09/19/2017 10:30 AM, Glen Willmot
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAB2677TCG5dJo9GBWGC9C=01cEu1fFXg13wVfbG_RsJuaDx=jg@mail.gmail.com">
<div dir="ltr">Good morning,
<div><br>
</div>
<div>Just curious on when we'll see an update on the apache2
release to version 2.4.28 to patch against the "Optionsbleed"
bug detailed by <span style="color:rgb(0,0,0);white-space:pre-wrap">CVE-2017-9798.</span></div>
<div><span style="color:rgb(0,0,0);white-space:pre-wrap">
</span></div>
<div><span style="color:rgb(0,0,0);white-space:pre-wrap">More info on the severity of this bug can be seen at: </span><font
color="#000000"><span style="white-space:pre-wrap"><a href="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html" moz-do-not-send="true">https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html</a></span></font></div>
<div><br>
</div>
<div><span style="color:rgb(0,0,0);white-space:pre-wrap">Thank you,</span></div>
<div><span style="color:rgb(0,0,0);white-space:pre-wrap">Glen</span></div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>