2026-11-02 15:39 UTC
Replies (7)
-
@atzanteol@sh.itjust.works 2026-11-02 19:11
It’s pretty bad…
-
@Humanbiscuit@lemmy.world 2026-11-02 20:57
Context from the article for those that don’t like clicking … Debian patched it on October 16. Ubuntu still doesn’t have a patch more than two weeks later. Every supported release, LTS included, is listed as “Vulnerable”. Ubuntu hasn’t shipped the patch nine days after it was rated 9.8 and six days after a working root exploit.
-
@Eggymatrix@sh.itjust.works 2026-11-02 21:02
Apparently ubuntu is for the latest features, not the latest security fixes, for those you need debian to be updated at the highest pace
-
@Psi9@kbin.earth 2026-11-02 21:38
you do know you can just put a firewall rule in to prevent any IP options from hitting the server The rule (matches header length > 20 bytes, i.e. IHL 6–15): iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP ufw: add -A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROP to /etc/ufw/before.rules, above the RELATED,ESTABLISHED accept line. Then run ufw reload. csf: put the iptables line in /usr/local/csf/bin/csfpre.sh so it survives csf restarts. Docker hosts: use -t raw -I PREROUTING instead, so container traffic is covered too. Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns. its a stopgap. not a fix. but you don't have to take all your servers offline ..... just put the block in and wait for the patch
-
@chgxvjh@hexbear.net 2026-11-02 22:07
It’s not really a 9.8
-
@umbrella@lemmy.ml 2026-11-03 06:11
canonical takes ages to ship patches sometimes, not just with security vulns. it’s part of the reason i hopped away.
-
@Strit@lemmy.linuxuserspace.show 2026-11-03 08:12
That feeling when Debian is more up-to-date than you…