<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Just FYI, the scanning vendor accepted all of the disputes based on people.canonical.com and usn.ubuntu.com.</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> ubuntu-server <ubuntu-server-bounces@lists.ubuntu.com> on behalf of Leroy Tennison <leroy@datavoiceint.com><br>
<b>Sent:</b> Tuesday, June 11, 2019 1:40:25 PM<br>
<b>To:</b> Robie Basak<br>
<b>Cc:</b> ubuntu-server@lists.ubuntu.com<br>
<b>Subject:</b> Re: Is there an official statement about the Ubuntu package version identifier</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p style="margin-top:0; margin-bottom:0">As I said previously, sorry for the delayed response. This is perfect, I wasn't aware of the significance of the usn link on
<a href="https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpeople.canonical.com&c=E,1,U2UvYxyDt9-E2DZRqEixxF_Xnup9lWhp-FEJmBHOHKCtEhl0Kqdv96rrqedsgV9E0miYBy0xfXd-wkn0QVKmvAOv03LZGnTUcdm1HYTKUyX8PA,,&typo=1">
people.canonical.com</a>, that is exactly what I am going to use in my reply to the scanning vendor. Thank you so much for your reply.</p>
</div>
<p id="x_c1-id-7" style="font-size:0px; font-family:Arial; color:#fff">Harriscomputer</p>
<table id="x_c1-id-8" style="border-left-width:0px; border-right-width:0px; border-bottom-width:0px; padding-bottom:0px; padding-top:0px; padding-left:0px; margin:0px; padding-right:0px; border-top-width:0px">
<colgroup id="x_c1-id-9"><col id="x_c1-id-10"></col></colgroup>
<tbody id="x_c1-id-11">
<tr id="x_c1-id-12">
<td id="x_c1-id-13">
<table id="x_c1-id-14" cellspacing="0" cellpadding="0" border="0" style="height:0px; width:100%">
<colgroup id="x_c1-id-15"><col id="x_c1-id-16"><col id="x_c1-id-17"><col id="x_c1-id-18"></col></col></col></colgroup>
<tbody id="x_c1-id-19">
<tr id="x_c1-id-27">
<td id="x_c1-id-28" style="width:33%">
<p align="left" style="font-size:10pt; font-family:Arial"><b id="x_c1-id-30"><font id="x_c1-id-31" face="Arial">Leroy Tennison<br id="x_c1-id-32">
</font></b><font id="x_c1-id-33" size="2" face="Arial">Network Information/Cyber Security Specialist<br id="x_c1-id-38">
<span id="x_c1-id-39" style="font-size:8pt">E: leroy@datavoiceint.com</span></font></p>
</td>
<td id="x_c1-id-40" style="width:33%">
<p align="center" style="font-size:10pt; font-family:Arial; text-align:center"><br id="x_c1-id-43">
<img border="0" data-outlook-trace="F:1|T:1" src="cid:Data-Voice-International-LOGO_aa3d1c6e-5cfb-451f-ba2c-af8059e69609.PNG"></p>
</td>
<td id="x_c1-id-45" style="width:33%">
<p id="x_c1-id-46" align="right" style="font-size:10pt; font-family:Arial; text-align:right">
<font id="x_c1-id-47" face="Arial" style="font-size:8pt">2220 Bush Dr<br id="x_c1-id-48">
McKinney, Texas<br id="x_c1-id-49">
75070<br>
<font id="x_c1-id-51" face="Arial" style="font-size:8pt"><a href="http://www..com">www.datavoiceint.com</a></font></font><font id="x_c1-id-56" size="3"> </font></p>
</td>
</tr>
</tbody>
</table>
<table id="x_c1-id-57" cellspacing="2" border="0" style="width:100%">
<colgroup id="x_c1-id-58"><col id="x_c1-id-59"><col id="x_c1-id-60"><col id="x_c1-id-61"></col></col></col></colgroup>
<tbody id="x_c1-id-62">
<tr id="x_c1-id-63">
<td id="x_c1-id-64" colspan="3">
<p id="x_c1-id-65" style="margin-bottom:0px; font-size:10pt; font-family:Arial; margin-top:0px">
<font id="x_c1-id-66" size="1" face="Arial">This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed
<a href="https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fsubscribe.harriscomputer.com%2f&c=E,1,TG6Wlsa00jfbvmN7XHTaEQTius88BeO00nJEY1SDKnLqvRB1q58phV2-UuCP03gdd8wF1zWw6fmYjWgav0yzGNua99qfFHaux5CZptorHAOo5YQ,&typo=1">
here</a>. </font></p>
<p style="margin-bottom:0px; font-size:10pt; font-family:Arial; margin-top:0px"><font size="1" face="Arial">If you prefer not to be contacted by Harris Operating Group
<a href="https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fsubscribe.harriscomputer.com%2f&c=E,1,Jmk0Bq1r3SPNqQ1AQXNWn6au-4k6zj1fUjro-dpHpmLlPdGx2RTH7g6D4MzvWkbzlBrIzINH7t353fHvACiIZOhkqHZ5kjB2Qalsx6EaoiUXFum-Cg,,&typo=1">
please notify us</a>. </font></p>
<p style="margin-bottom:0px; font-size:10pt; font-family:Arial; margin-top:0px"> </p>
<p style="margin-bottom:0px; font-size:10pt; font-family:Arial; margin-top:0px"><font size="1" face="Arial"></font></p>
<p style="margin-bottom:0px; font-size:10pt; font-family:Arial; margin-top:0px"><font size="1" face="Arial">This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary,
privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please
notify the sender immediately by e-mail and delete all copies of the message.</font></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p id="x_c1-id-74" style="font-size:10pt; font-family:Arial"> </p>
<P id=c1-id-7
style="FONT-SIZE: 0px; FONT-FAMILY: Arial; COLOR: #fff">Harriscomputer</P>
<TABLE id=c1-id-8
style="BORDER-LEFT-WIDTH: 0px; BORDER-RIGHT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px">
<COLGROUP id=c1-id-9>
<COL id=c1-id-10></COL></COLGROUP>
<TBODY id=c1-id-11>
<TR id=c1-id-12>
<TD id=c1-id-13>
<TABLE id=c1-id-14 style="HEIGHT: 0px; WIDTH: 100%" cellSpacing=0
cellPadding=0 border=0>
<COLGROUP id=c1-id-15>
<COL id=c1-id-16>
<COL id=c1-id-17>
<COL id=c1-id-18></COL></COL></COL></COLGROUP>
<TBODY id=c1-id-19>
<TR id=c1-id-27>
<TD id=c1-id-28 style="WIDTH: 33%">
<P style="FONT-SIZE: 10pt; FONT-FAMILY: Arial" align=left><B
id=c1-id-30><FONT id=c1-id-31 face=Arial>Leroy Tennison<BR
id=c1-id-32></FONT></B><FONT id=c1-id-33 size=2
face=Arial>Network Information/Cyber Security Specialist<BR id=c1-id-38><SPAN id=c1-id-39
style="FONT-SIZE: 8pt">E: leroy@datavoiceint.com</SPAN></FONT></P></TD>
<TD id=c1-id-40 style="WIDTH: 33%">
<P style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; TEXT-ALIGN: center"
align=center><BR id=c1-id-43><IMG border=0
src="cid:Data-Voice-International-LOGO_aa3d1c6e-5cfb-451f-ba2c-af8059e69609.PNG"></P></TD>
<TD id=c1-id-45 style="WIDTH: 33%">
<P id=c1-id-46
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial; TEXT-ALIGN: right"
align=right><FONT id=c1-id-47 style="FONT-SIZE: 8pt"
face=Arial>2220 Bush Dr<BR id=c1-id-48>McKinney, Texas<BR
id=c1-id-49>75070<BR><FONT id=c1-id-51
style="FONT-SIZE: 8pt" face=Arial><A
href="http://www..com">www.datavoiceint.com</A></FONT></FONT><FONT
id=c1-id-56 size=3> </FONT></P></TD></TR></TBODY></TABLE>
<TABLE id=c1-id-57 style="WIDTH: 100%" cellSpacing=2 border=0>
<COLGROUP id=c1-id-58>
<COL id=c1-id-59>
<COL id=c1-id-60>
<COL id=c1-id-61></COL></COL></COL></COLGROUP>
<TBODY id=c1-id-62>
<TR id=c1-id-63>
<TD id=c1-id-64 colSpan=3>
<P id=c1-id-65
style="MARGIN-BOTTOM: 0px; FONT-SIZE: 10pt; FONT-FAMILY: Arial; MARGIN-TOP: 0px"><FONT
id=c1-id-66 size=1 face=Arial>This message has been sent on behalf
of a company that is part of the Harris Operating Group of
Constellation Software Inc. These companies are listed <A
href="http://subscribe.harriscomputer.com/">here</A>. </FONT></P>
<P
style="MARGIN-BOTTOM: 0px; FONT-SIZE: 10pt; FONT-FAMILY: Arial; MARGIN-TOP: 0px"><FONT
size=1 face=Arial>If you prefer not to be contacted by Harris
Operating Group <A
href="http://subscribe.harriscomputer.com/">please notify us</A>.
</FONT></P>
<P
style="MARGIN-BOTTOM: 0px; FONT-SIZE: 10pt; FONT-FAMILY: Arial; MARGIN-TOP: 0px"> </P>
<P
style="MARGIN-BOTTOM: 0px; FONT-SIZE: 10pt; FONT-FAMILY: Arial; MARGIN-TOP: 0px"><FONT
size=1 face=Arial></FONT></P>
<P
style="MARGIN-BOTTOM: 0px; FONT-SIZE: 10pt; FONT-FAMILY: Arial; MARGIN-TOP: 0px"><FONT
size=1 face=Arial>This message is intended exclusively for the
individual or entity to which it is addressed. This communication
may contain information that is proprietary, privileged or
confidential or otherwise legally exempt from disclosure. If you are
not the named addressee, you are not authorized to read, print,
retain, copy or disseminate this message or any part of it. If you
have received this message in error, please notify the sender
immediately by e-mail and delete all copies of the
message.</FONT></P></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE>
<P id=c1-id-74
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> </P><hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Robie Basak <robie.basak@ubuntu.com><br>
<b>Sent:</b> Saturday, June 8, 2019 10:21:19 AM<br>
<b>To:</b> Leroy Tennison<br>
<b>Cc:</b> ubuntu-server@lists.ubuntu.com<br>
<b>Subject:</b> [EXTERNAL] Re: Is there an official statement about the Ubuntu package version identifier</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">Hi Leroy,<br>
<br>
Some additions to what others have already said:<br>
<br>
<a href="https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions" id="LPlnk811499" class="x_OWAAutoLink">https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions</a> points out "Sometimes
<div id="LPBorder_GT_15602781111690.7267508540963887" style="margin-bottom:20px; overflow:auto; width:100%; text-indent:0px">
<table id="LPContainer_15602781111640.7525736296870515" role="presentation" cellspacing="0" style="width:90%; background-color:rgb(255,255,255); overflow:auto; padding-top:20px; padding-bottom:20px; margin-top:20px; border-top:1px dotted rgb(200,200,200); border-bottom:1px dotted rgb(200,200,200)">
<tbody>
<tr valign="top" style="border-spacing:0px">
<td id="x_TextCell_15602781111660.855897029259838" colspan="2" style="vertical-align:top; padding:0px; display:table-cell">
<div id="LPRemovePreviewContainer_15602781111660.6478671722255283"></div>
<div id="LPTitle_15602781111660.6550829231076905" style="top:0px; color:rgb(0,120,215); font-weight:400; font-size:21px; font-family:wf_segoe-ui_light,"Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; line-height:21px">
<a id="LPUrlAnchor_15602781111670.10908521409896732" href="https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions" target="_blank" style="text-decoration:none">SecurityTeam/FAQ - Ubuntu Wiki</a></div>
<div id="LPMetadata_15602781111680.8637080645515269" style="margin:10px 0px 16px; color:rgb(102,102,102); font-weight:400; font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; line-height:14px">
wiki.ubuntu.com</div>
<div id="LPDescription_15602781111680.37598331585269973" style="display:block; color:rgb(102,102,102); font-weight:400; font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; line-height:20px; max-height:100px; overflow:hidden">
Official Support. What does official security support mean? Members of the Ubuntu Security team are Canonical employees who provide security updates for supported software in the Ubuntu distribution. Security updates are in part prioritized based on severity
of impact, exploitability and number of affected users.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
external security vendors doing software version scanning against Ubuntu<br>
systems do not check actual package versions, leading to false positives<br>
in their scan reports. For an authoritative source of what packages may<br>
have outstanding vulnerabilities, the Ubuntu CVE Tracker can be<br>
consulted."<br>
<br>
The Ubuntu CVE Tracker at<br>
<a href="https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpeople.canonical.com%2f~ubuntu-security%2fcve%2f2016%2fCVE-2016-5387.html&c=E,1,mtiohJnCvZnc1CdM-uqJsHUu87cl5O7feXmhb2-KABP09OqyKeK-nTrjURx8SyXb98fX3TURYi66y-3u1PkXl-QLYFG8U-0536A0KBkHBg4zB07ShpE,&typo=1" id="LPlnk84608" class="x_OWAAutoLink">https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpeople.canonical.com%2f~ubuntu-security%2fcve%2f2016%2fCVE-2016-5387.html&c=E,1,mtiohJnCvZnc1CdM-uqJsHUu87cl5O7feXmhb2-KABP09OqyKeK-nTrjURx8SyXb98fX3TURYi66y-3u1PkXl-QLYFG8U-0536A0KBkHBg4zB07ShpE,&typo=1</a><br>
says that the fix was released in package version "2.4.18-2ubuntu3.1"<br>
(in Xenial, for example), and I believe this database reflects the<br>
Ubuntu Security Team's official position. In addition it is confirmed in<br>
the linked announcement <a href="https://usn.ubuntu.com/3038-1/" id="LPlnk379959" class="x_OWAAutoLink">
https://usn.ubuntu.com/3038-1/</a> which certainly<br>
is an official statement.<br>
<br>
Is that is not sufficient for your needs, why isn't it?<br>
<br>
Robie<br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>