What does Upstream and Downstream mean?

With Redhat and CentOS (especially bugs and patches) I often see the terminology upstream and downstream. What do these terms mean in this context?

Example: Red Hat would like to thank the X.Org security team for reporting this issue. Upstream acknowledges Rafal Wojtczuk as the original reporter.

From the perspective a Linux distributor upstream usually refers to the original author(s) of the source for a particular package. Downstream may refer to a distribution that has forked/branched from the perspective of the distro you are looking at.

So if Debian receives a bug relating to Apache, then package maintainer or anyone reading the bugs may do some investigation. If they determine the bug is in the original source code, and not cause by something unique to the distribution they will work with the upstream authors to work on fixing the bug in program.

If the upstream developer is uncooperative or no longer exists then the developer may add a patch that applies to the package, effectively forking to a certain extent from the upstream development.

Once the bug is found they may work with the downstream distros like Ubuntu to make sure the bug is fixed everywhere. Downstream maintainers may submit issues related to things having to do with the packaging or any patches added.

If you are working on something like Mint which is based on Ubuntu, which is based on Debian the term upstream could mean any one of the maintainers between the current distro, or it could refer to the original author(s). When maintainers and author(s) of a particular package are working well together usually all of them will be subscribed to similar maillists, and bugtrackers and anyone with some responsibility for a given package will be notified in some form about bugs and new patches made at any level.