Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230
[SOLVED] apt does not see security update
[SOLVED] apt does not see security update
Hello:
I have been reading up on how to keep Debian secure and have updated dozens of packages on a couple of servers running Debian Buster. I had no problems until yesterday when I tried to update apache2 in response to a security update issued by the Debian security team. However, I have not been able to get my servers to "see" the update. When I run apt upgrade and apt list --upgradable, the system returns nothing.
I thought the problem might be in sources.list. The file looked ok to me, since it explicitly refers to Buster and so I don't have to change stable to oldstable, but I added contrib and non-free to all lines and also added a line to explicitly point to security updates. My system still doesn't see the update. Here are the contents of my sources.list file:
deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free
deb http://security.debian.org/debian-security buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security buster/updates main contrib non-free
# Added this line on 1/4/22 to see if it helps to find security updates
deb http://security.debian.org/debian-security buster-security main contrib non-free
# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free
The security update says the bugs identified are fixed in version 2.4.38-3+deb10u7. I verified I am running 2.4.38-3+deb10u6. Does anyone know what I'm doing wrong? Thank you.
I have been reading up on how to keep Debian secure and have updated dozens of packages on a couple of servers running Debian Buster. I had no problems until yesterday when I tried to update apache2 in response to a security update issued by the Debian security team. However, I have not been able to get my servers to "see" the update. When I run apt upgrade and apt list --upgradable, the system returns nothing.
I thought the problem might be in sources.list. The file looked ok to me, since it explicitly refers to Buster and so I don't have to change stable to oldstable, but I added contrib and non-free to all lines and also added a line to explicitly point to security updates. My system still doesn't see the update. Here are the contents of my sources.list file:
deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free
deb http://security.debian.org/debian-security buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security buster/updates main contrib non-free
# Added this line on 1/4/22 to see if it helps to find security updates
deb http://security.debian.org/debian-security buster-security main contrib non-free
# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free
The security update says the bugs identified are fixed in version 2.4.38-3+deb10u7. I verified I am running 2.4.38-3+deb10u6. Does anyone know what I'm doing wrong? Thank you.
Last edited by cschnaars on 2022-01-05 21:57, edited 1 time in total.
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: apt does not see security update
The debian-security part is Bullseye - in Buster was just debian. I know because I edited my sources.list this morning to update Buster to Bullseye on a computer.
Try:
Try:
Code: Select all
deb http://deb.debian.org/debian buster/security main contrib non-free
Re: apt does not see security update
So I added the repo definition you suggested to my sources.list file. My system still does not see the apache2 update. Any other ideas?
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: apt does not see security update
Yes. Here is the output.
Hit:1 http://deb.debian.org/debian buster InRelease
Ign:2 http://deb.debian.org/debian buster/security InRelease
Hit:3 http://deb.debian.org/debian buster-updates InRelease
Err:4 http://deb.debian.org/debian buster/security Release
404 Not Found [IP: 146.75.34.132 80]
Hit:5 https://packages.microsoft.com/debian/10/prod buster InRelease
Reading package lists... Done
E: The repository 'http://deb.debian.org/debian buster/security Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
Current content of sources.list: (I have not altered anything in response to the error returned above.)
deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free
#deb http://security.debian.org/debian-security buster/updates main contrib non-free
#deb-src http://security.debian.org/debian-security buster/updates main contrib non-free
#deb http://security.debian.org/debian-security buster-security main contrib non-free
deb http://deb.debian.org/debian buster/security main contrib non-free
# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free
Hit:1 http://deb.debian.org/debian buster InRelease
Ign:2 http://deb.debian.org/debian buster/security InRelease
Hit:3 http://deb.debian.org/debian buster-updates InRelease
Err:4 http://deb.debian.org/debian buster/security Release
404 Not Found [IP: 146.75.34.132 80]
Hit:5 https://packages.microsoft.com/debian/10/prod buster InRelease
Reading package lists... Done
E: The repository 'http://deb.debian.org/debian buster/security Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
Current content of sources.list: (I have not altered anything in response to the error returned above.)
deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free
#deb http://security.debian.org/debian-security buster/updates main contrib non-free
#deb-src http://security.debian.org/debian-security buster/updates main contrib non-free
#deb http://security.debian.org/debian-security buster-security main contrib non-free
deb http://deb.debian.org/debian buster/security main contrib non-free
# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: apt does not see security update
Sorry, if you'd asked me this morning I could've told you straight away what the repository was on Buster, but now that computer is running Bullseye. It doesn't help that debian.org lists two different security repositories and the format has changed.
Could you try:
Edit: I think this one is right - it's from the Debian handbook for Buster. The previous one I found on the Debian User Forum - obviously a source of dubious misinformation.
https://debian-handbook.info/browse/stable/apt.html
I also ran into the same problem in Buster and blogged about it, but unfortunately didn't remember the post at first.
https://dontsurfinthenude.blogspot.com/ ... wrong.html
Could you try:
Code: Select all
deb http://security.debian.org/ buster/updates main contrib non-free
https://debian-handbook.info/browse/stable/apt.html
I also ran into the same problem in Buster and blogged about it, but unfortunately didn't remember the post at first.
https://dontsurfinthenude.blogspot.com/ ... wrong.html
Re: apt does not see security update
Unfortunately, the updated code also does not work.
I had no trouble getting security-specific updates in the past. I presume the problem is related to the fact Buster has gone from stable to oldstable. Now I'm wondering if there is some dependency or something else on my system that is blocking the upgrade. I got my initial repo settings from the handbook as well.
Thank you very much for trying to help me. Hoping you or someone else has other ideas. It's got to be something simple.
I had no trouble getting security-specific updates in the past. I presume the problem is related to the fact Buster has gone from stable to oldstable. Now I'm wondering if there is some dependency or something else on my system that is blocking the upgrade. I got my initial repo settings from the handbook as well.
Thank you very much for trying to help me. Hoping you or someone else has other ideas. It's got to be something simple.
Re: apt does not see security update
Just for the heck of it, I just tried to update the package directly. My system does not see the new version:
$ sudo apt install apache2
Reading package lists... Done
Building dependency tree
Reading state information... Done
apache2 is already the newest version (2.4.38-3+deb10u6).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
$ sudo apt install apache2
Reading package lists... Done
Building dependency tree
Reading state information... Done
apache2 is already the newest version (2.4.38-3+deb10u6).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Re: apt does not see security update
Code: Select all
@:/# cat /etc/apt/sources.list
#
# deb cdrom:[Official Debian GNU/Linux Live 10.10.0 cinnamon 2021-06-19T12:44]/ buster main
# deb cdrom:[Official Debian GNU/Linux Live 10.10.0 cinnamon 2021-06-19T12:44]/ buster main
# Line commented out by installer because it failed to verify:
#deb http://security.debian.org/debian-security buster/updates main
# Line commented out by installer because it failed to verify:
#deb-src http://security.debian.org/debian-security buster/updates main
# buster-updates, previously known as 'volatile'
# A network mirror was not selected during install. The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.
#
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free
deb http://deb.debian.org/debian buster main contrib non-free
deb-src http://deb.debian.org/debian buster main contrib non-free
#deb http://deb.debian.org/debian-security/ buster-security main contrib non-free
#deb-src http://deb.debian.org/debian-security/ buster-security main contrib non-free
deb http://security.debian.org/debian-security/ buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security/ buster/updates main contrib non-free
deb http://security.debian.org/ buster/updates main contrib non-free
#you need this ^^^^^
Code: Select all
apt update -y && apt upgrade -y
Re: apt does not see security update
This worked! Thank you very much! And thank you, FreewheelinFrank, for all your time in helping me to chase this down.
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: [SOLVED] apt does not see security update
There seem to be two security repositories in that list. Which one worked?
Re: [SOLVED] apt does not see security update
It's this one:FreewheelinFrank wrote: ↑2022-01-05 22:35 There seem to be two security repositories in that list. Which one worked?
Code: Select all
deb http://security.debian.org/ buster/updates main contrib non-free
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: [SOLVED] apt does not see security update
Seems to be exactly the same one I posted earlier that didn't work.zwab wrote: ↑2022-01-06 03:00It's this one:FreewheelinFrank wrote: ↑2022-01-05 22:35 There seem to be two security repositories in that list. Which one worked?Code: Select all
deb http://security.debian.org/ buster/updates main contrib non-free
FreewheelinFrank wrote: ↑2022-01-05 16:42 Could you try:Code: Select all
deb http://security.debian.org/ buster/updates main contrib non-free
zwab wrote: ↑2022-01-05 20:50 deb http://security.debian.org/ buster/updates main contrib non-free
#you need this ^^^^^[/code]Code: Select all
apt update -y && apt upgrade -y
Re: [SOLVED] apt does not see security update
FreewheelinFrank you're right. This is the code you posted earlier. The only thing I can figure is that in patching sources.list, apt must not have liked one of the URLs listed before the correct one you provided.
Yesterday I patched our Staging server. I patched our Production server this morning by changing these two lines in sources.list:
deb http://security.debian.org/debian-security buster/updates main
deb-src http://security.debian.org/debian-security buster/updates main
To this:
deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free
With these two lines in place, apache2 updated right away.
Thanks again to both of you for your help.
Yesterday I patched our Staging server. I patched our Production server this morning by changing these two lines in sources.list:
deb http://security.debian.org/debian-security buster/updates main
deb-src http://security.debian.org/debian-security buster/updates main
To this:
deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free
With these two lines in place, apache2 updated right away.
Thanks again to both of you for your help.
- FreewheelinFrank
- Global Moderator
- Posts: 2107
- Joined: 2010-06-07 16:59
- Has thanked: 38 times
- Been thanked: 230 times
Re: [SOLVED] apt does not see security update
No problem.
Bear in mind that the former is correct for Debian 11, so if you ever update you will see the same errors with what are now your working repositories until you change them again.
Bear in mind that the former is correct for Debian 11, so if you ever update you will see the same errors with what are now your working repositories until you change them again.