mitmproxy - Debian Package Tracker

general

source: mitmproxy (main)
version: 8.1.1-3
maintainer: Debian Python Team (DMD)
uploaders: Andrej Shadura [DMD]
arch: all
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.0.4-5
oldstable: 6.0.2-1
stable: 8.1.1-2
unstable: 8.1.1-3

versioned links

4.0.4-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.0.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.1.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.1.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

mitmproxy (4 bugs: 0, 3, 1, 0)

action needed

A new upstream version is available: 12.1.1 high

A new upstream version 12.1.1 is available, you should consider packaging it.

Created: 2022-11-19 Last update: 2025-06-21 15:01

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2025-23217: mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Created: 2025-02-07 Last update: 2025-05-17 21:31

lintian reports 4 warnings high

Lintian reports 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2023-02-10 Last update: 2024-10-05 18:33

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 20-day delay is over. Check why.

Created: 2025-06-07 Last update: 2025-06-21 17:32

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2025-01-29 Last update: 2025-06-21 17:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 8.1.1-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit aea98a75b2f4b0aee640ee2e2df9b79dfd9f93b9
Author: Emmanuel Arias <eamanu@yaerobi.com>
Date:   Fri Jun 6 20:32:37 2025 -0300

    Fix CVE-2025-23217: mitmweb's API now requires an authentication token by default. While the client cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution (Closes: #1103701).

commit 506e3378bfe0747d23b62d20b4a4df5dbb573977
Author: Emmanuel Arias <eamanu@debian.org>
Date:   Mon Jun 2 15:30:04 2025 -0300

    * d/patches/0008-Stop-using-blinker._saferef.patch: Add patch to stop
      using blinker._saferef module (Closes: #1071640).

Created: 2025-06-02 Last update: 2025-06-15 06:32

debian/patches: 6 patches to forward upstream low

Among the 6 debian patches available in version 8.1.1-3 of the package, we noticed the following issues:

6 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-05-18 08:00

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2025-23217: (needs triaging) mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-02-07 Last update: 2025-05-17 21:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.6.2).

Created: 2024-04-07 Last update: 2025-05-17 23:00

testing migrations

excuses:
- Migration status for mitmproxy (- to 8.1.1-3): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating mitmproxy would introduce bugs in testing: #1071640, #1103701
- ∙ ∙ blocked by freeze: is not in testing
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/m/mitmproxy.html
- ∙ ∙ Reproducible on amd64 - info ♻
- ∙ ∙ Reproducible on arm64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
- ∙ ∙ 34 days old (needed 20 days)
- Not considered

news

[rss feed]

[2025-05-17] Accepted mitmproxy 8.1.1-3 (source) into unstable (Alexandre Detiste)
[2024-07-10] mitmproxy REMOVED from testing (Debian testing watch)
[2023-03-14] mitmproxy 8.1.1-2 MIGRATED to testing (Debian testing watch)
[2023-03-02] Accepted mitmproxy 8.1.1-2 (source) into unstable (Aron Xu)
[2023-02-08] mitmproxy 8.1.1-1 MIGRATED to testing (Debian testing watch)
[2023-02-05] Accepted mitmproxy 8.1.1-1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2023-01-30] mitmproxy 6.0.2-2 MIGRATED to testing (Debian testing watch)
[2023-01-24] Accepted mitmproxy 6.0.2-2 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2021-01-09] mitmproxy 6.0.2-1 MIGRATED to testing (Debian testing watch)
[2021-01-06] Accepted mitmproxy 6.0.2-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2021-01-04] Accepted mitmproxy 5.3.0-3 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2021-01-04] mitmproxy 5.3.0-2 MIGRATED to testing (Debian testing watch)
[2020-12-30] Accepted mitmproxy 5.3.0-2 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-12-06] mitmproxy 5.3.0-1 MIGRATED to testing (Debian testing watch)
[2020-11-30] Accepted mitmproxy 5.3.0-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-07-05] mitmproxy 5.1.1-2 MIGRATED to testing (Debian testing watch)
[2020-06-29] Accepted mitmproxy 5.1.1-2 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-06-19] Accepted mitmproxy 5.1.1-1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-06-18] mitmproxy REMOVED from testing (Debian testing watch)
[2020-04-14] mitmproxy 4.0.4-6.1 MIGRATED to testing (Debian testing watch)
[2020-04-08] Accepted mitmproxy 4.0.4-6.1 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-02-19] mitmproxy REMOVED from testing (Debian testing watch)
[2019-08-30] Accepted mitmproxy 0.18.2-6+deb9u2 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Sebastien Delafond)
[2019-08-25] Accepted mitmproxy 0.18.2-6+deb9u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Sebastien Delafond)
[2019-07-09] mitmproxy 4.0.4-6 MIGRATED to testing (Debian testing watch)
[2019-05-23] Accepted mitmproxy 4.0.4-6 (source) into unstable (Sebastien Delafond)
[2019-04-02] mitmproxy 4.0.4-5 MIGRATED to testing (Debian testing watch)
[2019-03-04] Accepted mitmproxy 4.0.4-5 (source) into unstable (Sebastien Delafond)
[2018-09-05] mitmproxy 4.0.4-4 MIGRATED to testing (Debian testing watch)
[2018-08-30] Accepted mitmproxy 4.0.4-4 (source) into unstable (Sebastien Delafond)

bugs [bug history graph]

all: 7
RC: 1
I&N: 4
M&W: 1
F&P: 1
patch: 1

links

homepage
lintian (0, 4)
buildd: logs
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 8.1.1-3
2 bugs