When installing a fresh Unbound via the apt command I'd expect it to pull the latest version 1.13. in reviewing the install it's only pulling version 1.9.0
Debug Token: https://tricorder.pi-hole.net/fjnof79nde
Thank you in advance.
That's all up to the OS distribution you are using. You'll have to wait until Raspbian has it. Is there a particular reason you need 1.13.0?
No, was just doing a clean install and happened to notice..
Will Bullseye still run smoothly on RaspberryPI Zero?
I'm asking not to shut anything down here but of pure interest: How is this related to Pi-hole at all?
If there is a striving reason for upgrading to 1.13.0, I would like to know it. I would consider compiling unbound from source in this case. Otherwise, just upgrading because it is newer (without any other reason) seems like a lot of work for nothing. Yes, they may fixed security issues, but even they should be mentioned in the Changelog.
Maybe I did 
What you quotes says:
- One issue that is fixed with 1.12.0 with
Severity: Lowand it says that because someone wanting to exploit this needs access to the machine. - Two issues that are fixed with 1.10.0 with
Severity: Medium. They are both hard to exploit. They both depend on maliciously configured upstream servers. It is rather unlikely that you will encounter them when runningunboundin the way recommended by Pi-hole (recursive resolver). - One issues that is fixed with 1.9.5: Doesn't apply (we are not using
ipsec) - One issue that is fixed with 1.9.4: Even though marked as
Mediumit is really really hard to exploit.
There is nothing else in there that convinces me personally from the need to update.
Sorry I made you think I didn't do my homework 
1 Like
And you'll see that the current Debian package has the backported security fixes as is the custom of Debian packages.
https://metadata.ftp-master.debian.org/changelogs//main/u/unbound/unbound_1.9.0-2+deb10u2_changelog
2 Likes
Thanks @DanSchaper. I indeed missed that. So all of the mentioned security issues are already fixed in the Debian 1.9.0, excluding
That is very useful information, thanks 
That's good to know. Thanks
I noticed a lot that a lot of independent developers complain that Debian and Ubuntu seem to have outdated packages of their software in Debian/Ubuntu repo.
It is true that they complain a lot. However, often it is not correct what they are complaining about.
Debian (and Ubuntu) conserve specific versions but they do add important security fixes as backports. This ensures you get no "surprises" on a running system. No config file option renamings and other things that could break entire systems. It is even worse with CentOS and others having a more conservative strategy:software is even outdated when they release, on Debian it just gets outdated over the long lifetime of their releases.
I'm using Fedora as my operating system. It is close to bleeding edge and this can be frustrating, too. There was a time, maybe last year, when my graphics card just stopped working. Turned out to be an incompatibility in the driver. Fix was simple but required booting from an external thumbdrive. No fun.
I used to love Fedora, but couldn't keep up with the constant releases and constant need for fresh install and need for new hardware, etc....
What a shame that they pulled the plug on Centos, I bet it was the most used Linux distro ever or maybe even most used Server distro.
I disagree. I doubt it is even within the TOP 10 for desktop systems. Debian / Ubuntu are much more common. Even for servers, I'd see Debian and Ubuntu server in front of CentOS.
Not even Top 10?
Well I won't argue, even if I wish I could be right, Centos will be gone for sure.
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.