>=v3.0.13 release for ubuntu 22.04

[imgurbot12]

Hello, I'm a developer making use of libmodsecurity for securing a variety of web applications.

Many of our applications run on Ubuntu Server 22.04. However, Ubuntu's packaging only supports installation for 3.0.12.

This has become an issue since many of the existing bindings for various languages only actively support the latest version: http://github.com/rkrishn7/rust-modsecurity/issues/21

Is there any way to get more recent versions of libmodsecurity published for the current LTS release to take advantage of the existing fixes and security upgrades in the latest releases?

Thank you.

[airween]

Hi @imgurbot12,

Many of our applications run on Ubuntu Server 22.04. However, Ubuntu's packaging only supports installation for 3.0.12.

Sorry to say, but I'm not sure, 22.04 has the package with version 3.0.12 - as I see your link shows Ubuntu version 24.04, not 22.04. 24.04 contains 3.0.12, but as I see 22.04 contains 3.0.6.

Is there any way to get more recent versions of libmodsecurity published for the current LTS release to take advantage of the existing fixes and security upgrades in the latest releases?

I'm the package maintainer in Debian, and I assume Ubuntu uses the same packages.

Debian has its own release procedure - a quick review of that: if a package has a new upstream version, then maintainers make the new package, I mean a package with a new version number. This package will be uploaded to Debian SID (Still In Development - and the character Sid from Toy Story; but SID is permanently the "beta" release). If the package is stable and no reports against that, after a few weeks the developers move that into Debian Testing. The current testing will be the next stable.

Ubuntu releases a new version in every half year, but Debian only releases its own version if they think the system is stable enough.

This is how it could have happened that Ubuntu 22.04 contains a libmodsecurity3 version which has never been released in Ubuntu - but it was part of SID! (see changelogs below).

See again your question:

existing fixes and security upgrades

We should split this into two pieces: fixes AND security upgrades.

Debian has its own policy, in short: if a package will be part of the system, you definitely cannot add new release from upstream, but you definitely must add the security fixes.

Because I'm the package maintainer, I always add security patches, but I can add them only to released versions.

Because the 3.0.6 was never been released, then - unfortunately - I've never added any patch that, see changelog

But if you take a look at Debian's packages:

• 3.0.4's changelog
• 3.0.9's changelog

Note, that in changelog of 3.0.9 you can see the entry with 3.0.6, but that - as I mentioned - never been released.

What can you do now anyway?

The company where I work for support ModSecurity (this is why I can develop...), and we have a ModSecurity repository. We provide the last releases (and not just releases, but current states) for all supported Debian and Ubuntu systems, including 22.04. For example now the current released version is 3.0.14, but we usually publish packages between two releases (you can imagine that as a "bleeding edge" release), therefore we publish them with next version + -pre suffix. Please read carefully the site:

https://modsecurity.digitalwave.hu

I hope this will help you - let me know if you have any question.

[imgurbot12]

Hey @airween, I appreciate the very thorough response thank you!

Though I have to embarrassingly admit that I meant Ubuntu 24.04 and somehow managed to get it wrong in both the title and the post lol. This is what I get for trying to be productive late at night :P

However, I'd imagine all the same advice applies to 24.04 from what you've said. If I'm hearing you correctly, it's not likely that ubuntu's official packages will update anytime soon unless its specifically a security patch (which they make exceptions for). And if we want to use the latest version on older LTS releases we'll likely need to use an extra repository like the one you posted.

Is that correct?

[airween]

If I'm hearing you correctly, it's not likely that ubuntu's official packages will update anytime soon unless its specifically a security patch (which they make exceptions for).

Yes,

And if we want to use the latest version on older LTS releases we'll likely need to use an extra repository like the one you posted.

Yes.

Both are correct.

[imgurbot12]

Perfect. Thank you again for the info and your work on modsecurity :)