Pain in the PaaS: The Problem of Lagging Security Updates at Heroku (opens in new tab)

(patchworksecurity.com)

4 pointsShamiq10y ago2 comments

2 comments

I didn't go through each vulnerability, but I'd bet that the Heroku security team did as at least some of the vulns don't really seem to apply to Heroku.

Case in point: you for sure are not running MySQL on a Heroku dyno.

ShamiqOP10y ago

You've got a point there, but I'd ask why not remove the packages that aren't being used? Here's some of the raw data about which system libraries are lagging in security patches:

  liblwres90 1:9.9.5.dfsg-3ubuntu0.6
  mysql-common 5.5.46-0ubuntu0.14.04.2
  libmysqlclient-dev 5.5.46-0ubuntu0.14.04.2
  libmysqlclient18 5.5.46-0ubuntu0.14.04.2
  rsync 3.1.0-2ubuntu0.1
  bind9-host 1:9.9.5.dfsg-3ubuntu0.6
  libisccc90 1:9.9.5.dfsg-3ubuntu0.6
  libisc95 1:9.9.5.dfsg-3ubuntu0.6
  dnsutils 1:9.9.5.dfsg-3ubuntu0.6
  linux-libc-dev 3.13.0-74.118
  libbind9-90 1:9.9.5.dfsg-3ubuntu0.6
  libxml2 2.9.1+dfsg1-3ubuntu4.6
  libdns100 1:9.9.5.dfsg-3ubuntu0.6
  libxml2-dev 2.9.1+dfsg1-3ubuntu4.6
  libisccfg90 1:9.9.5.dfsg-3ubuntu0.6

j / k navigate · click thread line to collapse

2 comments

michaelbuckbee10y ago

I didn't go through each vulnerability, but I'd bet that the Heroku security team did as at least some of the vulns don't really seem to apply to Heroku.

Case in point: you for sure are not running MySQL on a Heroku dyno.

ShamiqOP10y ago

You've got a point there, but I'd ask why not remove the packages that aren't being used? Here's some of the raw data about which system libraries are lagging in security patches:

  liblwres90 1:9.9.5.dfsg-3ubuntu0.6
  mysql-common 5.5.46-0ubuntu0.14.04.2
  libmysqlclient-dev 5.5.46-0ubuntu0.14.04.2
  libmysqlclient18 5.5.46-0ubuntu0.14.04.2
  rsync 3.1.0-2ubuntu0.1
  bind9-host 1:9.9.5.dfsg-3ubuntu0.6
  libisccc90 1:9.9.5.dfsg-3ubuntu0.6
  libisc95 1:9.9.5.dfsg-3ubuntu0.6
  dnsutils 1:9.9.5.dfsg-3ubuntu0.6
  linux-libc-dev 3.13.0-74.118
  libbind9-90 1:9.9.5.dfsg-3ubuntu0.6
  libxml2 2.9.1+dfsg1-3ubuntu4.6
  libdns100 1:9.9.5.dfsg-3ubuntu0.6
  libxml2-dev 2.9.1+dfsg1-3ubuntu4.6
  libisccfg90 1:9.9.5.dfsg-3ubuntu0.6

j / k navigate · click thread line to collapse