# HAProxy 2.0.14 (with vulnerability fix) package for ubuntu & debian stretch

**URL:** <https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049>\
**Category:** Help!\
**Created:** [April 9, 2020, 3:29pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049 "2020-04-09T15:29:18Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![tt100](https://avatars.discourse-cdn.com/v4/letter/t/9fc29f/32.png) [@tt100](https://discourse.haproxy.org/u/tt100)\
**Post date:** [April 9, 2020, 3:29pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/1 "2020-04-09T15:29:18Z")

</div>

Could anyone please point me to from where I can download debian package for HAProxy 2.0.14 (2.0 version with the fix for HPACK vulnerability). Thanks.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 9, 2020, 3:38pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/2 "2020-04-09T15:38:32Z")

</div>

Both Debian and Ubuntu have the fix, what package are you using currently exactly which you are concerned about?

---

<div class="post-metadata">

**Author:** ![tt100](https://avatars.discourse-cdn.com/v4/letter/t/9fc29f/32.png) [@tt100](https://discourse.haproxy.org/u/tt100)\
**Post date:** [April 9, 2020, 3:41pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/3 "2020-04-09T15:41:26Z")

</div>

I was looking for the source to download those packages, everywhere I see is giving HAProxy 2.0.13  
Eg: [https://haproxy.debian.net/#?distribution=Ubuntu&release=xenial&version=2.0](https://haproxy.debian.net/#?distribution=Ubuntu&release=xenial&version=2.0)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 9, 2020, 3:43pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/4 "2020-04-09T15:43:47Z")

</div>

Vincent Bernard’s PPA packages have been update on April 2nd, with the bugfix for this issue. You don’t have to do anything if you are using those packages.

---

<div class="post-metadata">

**Author:** ![tt100](https://avatars.discourse-cdn.com/v4/letter/t/9fc29f/32.png) [@tt100](https://discourse.haproxy.org/u/tt100)\
**Post date:** [April 9, 2020, 3:47pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/5 "2020-04-09T15:47:43Z")

</div>

I am using package 2.0.10 currently. Don’t see package update for this version.  
I’ll have to move to 2.0.14 only, right?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 9, 2020, 4:03pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/6 "2020-04-09T16:03:15Z")

</div>

If you tell me what OS and release you are using and how exactly you installed this haproxy 2.0.10 release, then I can tell you what you have to do.

> [@tt100](#):
>
> I’ll have to move to 2.0.14 only, right?

No, you most likely don’t have to upgrade to 2.0.14, because security fixes get backported to packages in the OS repositories.

---

<div class="post-metadata">

**Author:** ![tt100](https://avatars.discourse-cdn.com/v4/letter/t/9fc29f/32.png) [@tt100](https://discourse.haproxy.org/u/tt100)\
**Post date:** [April 9, 2020, 4:09pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/7 "2020-04-09T16:09:15Z")

</div>

Sure @lukastribus  
OS:

1. Debian Stretch
2. Ubuntu 16.04

For both HAProxy 2.0.10 is being used.

For installing this HAProxy 2.0.10, I got debian package using Vincent Bernard’s PPA packages and then installed the packages on our systems.  
Debian package source:

1. [https://haproxy.debian.net/#?distribution=Debian&release=stretch&version=2.0](https://haproxy.debian.net/#?distribution=Debian&release=stretch&version=2.0)
2. [https://haproxy.debian.net/pool/main/h/haproxy/](https://haproxy.debian.net/pool/main/h/haproxy/)  
For ubuntu, I got it from: [https://launchpad.net/~vbernat/+archive/ubuntu/haproxy-2.0/+builds?build\_state=built](https://launchpad.net/~vbernat/+archive/ubuntu/haproxy-2.0/+builds?build_state=built)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 9, 2020, 4:13pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-14-with-vulnerability-fix-package-for-ubuntu-debian-stretch/5049/8 "2020-04-09T16:13:14Z")

</div>

`apt-get update && apt-get upgrade` is all you need, if you used the proper procedure as indicated on that website.

If on the other hand you manually downloaded the .deb file and installed it from the filesystem via dpkg or something, then go back to the website and follow the procedure to install it properly, which will get you 2.0.13 with the backported security fix.