Is there an official statement about the Ubuntu package version identifier

[Leroy Tennison]

The reason I ask is I have a commercial vulnerability scanner reporting as "fail" a test (for example, CVE-2016-5387)of our systems where https://people.canonical.com/~ubuntu-security/cve/ states that a fix has been released and our current version appears to be later than that release.  I need to dispute that finding for compliance reasons but would like an official statement to show to the vendor concerning how Ubuntu handles these things.  I suspect the vendor is only checking the upstream major and minor version number rather than actually testing and thus concluding a "fail" erroneously.


Harriscomputer

Leroy Tennison
Network Information/Cyber Security Specialist
E: leroy at datavoiceint.com


[cid:Data-Voice-International-LOGO_aa3d1c6e-5cfb-451f-ba2c-af8059e69609.PNG]


2220 Bush Dr
McKinney, Texas
75070
www.datavoiceint.com<http://www..com>


This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed here<http://subscribe.harriscomputer.com/>.

If you prefer not to be contacted by Harris Operating Group please notify us<http://subscribe.harriscomputer.com/>.



This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-server/attachments/20190606/bc84fa66/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 8276 bytes
Desc: Data-Voice-International-LOGO_aa3d1c6e-5cfb-451f-ba2c-af8059e69609.PNG
URL: <https://lists.ubuntu.com/archives/ubuntu-server/attachments/20190606/bc84fa66/attachment.png>