CVE-2016-6213 was reported three years ago by OpenVZ developer

https://bugzilla.redhat.com/show_bug.cgi?id=1356471#c6

by ligurio • 10 years ago

43 14 10 years ago

bugzilla.redhat.com

gnoway• 10 years ago

It was actually two years ago, if someone wants to correct the title.

Edit: I clearly can't read. Upvoted you both, thanks.

laurencei• 10 years ago

No - the comment text says "I've reported this problem two years ago" - but the date of the report is 20th Jun 2013 - which is definitely 3 years ago

mgraczyk• 10 years ago

The email was sent in June 2013, three years ago. The author mistyped the year in his comment on the bug report.

mrmondo3• 10 years ago

Interesting, my 2c: You shouldn't be using OpenVZ in 2016 regardless, I know lots of budget web hosting providers still provide it as an option but really IMO they should have moved on around 2-3 years ago.

chii• 10 years ago

why not?

jamescun• 10 years ago

May I ask why not?

I feel OpenVZ gets a bad rap simply because of the "pop up" VPS providers who oversell and under-provision. It is a mature, maintained containerisation system. Yes it still requires kernel patches (created before Linux had namespaces/cgroups etc) but the team is actively working on merging missing functionality upstream and adapting OpenVZ tools to support things like namespaces and cgroups.

Fizzadar• 10 years ago

This. I've used OpenVZ for internal containerisation (before the whole Docker explosion) without any issues. It's fast and provides what feels like a fully blown virtual machine. Yes, it's a bit out of date these days (being on Linux 2.6), but it's still an incredibly useful tool, and I see no reason to stop using it.

mrmondo3• 10 years ago

Well for starters I believe it still relies on Kernel 2.6, I think they forked the kernel then never kept it up to date, I could be wrong about this but it certainly was the case up until recently at least. Looking at OpenVZ's website it also seems to only official support RHEL 5/6 as stable host options which were behind their time at point of release and now in 2016 really are very, _very_ old dogs.

LXC and Docker, especially when combined with a virtualisation layer and SELinux are modern, stable, well maintained options that are not only easy to configure and manage but do not require custom kernel patches etc...

ligurio2• 10 years ago

Really? OpenVZ still has some advantages to compare with other virtualization solutions https://openvz.org/Comparison

mrmondo3• 10 years ago

Thats not even close to up to date and is incorrect.

They're only just moving from their 2009 Kernel fork to a fork of Kernel 3.10 which was released in 2013...

Edit: In fact, on second inspection, a lot of the items in that table are either wrong or straight out lies (although I'm assuming the former). I'd hate to think what the community around the product is like but I can only assume they live in a bubble similar to those in the Drupal community that thinks for whatever reason that the product they're using is the one and only / best solution rather than truly evaluating the best tool for the job, as far as I can see it unless that page you linked to truly isn't maintained thats the only way you could end up with that quality of information / misinformation available.

Edit2: Formatting

CVE-2016-6213 was reported three years ago by OpenVZ developer

Related Stories