curl - Debian Package Tracker

general

source: curl (main)
version: 8.11.0-1
maintainer: Debian Curl Maintainers (DMD)
uploaders: Sergio Durigan Junior [DMD] – Samuel Henrique [DMD] – Carlos Henrique Lima Melara [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 7.64.0-4+deb10u2
o-o-sec: 7.64.0-4+deb10u9
oldstable: 7.74.0-1.3+deb11u13
old-sec: 7.74.0-1.3+deb11u14
old-bpo: 7.88.1-10+deb12u6~bpo11+1
old-p-u: 7.74.0-1.3+deb11u13
stable: 7.88.1-10+deb12u8
stable-sec: 7.88.1-10+deb12u5
stable-bpo: 8.10.1-1~bpo12+1
testing: 8.11.0-1
unstable: 8.11.0-1

versioned links

7.64.0-4+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.64.0-4+deb10u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.74.0-1.3+deb11u13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.74.0-1.3+deb11u14: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.88.1-10+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.88.1-10+deb12u6~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.88.1-10+deb12u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.6.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.10.1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.11.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

curl (42 bugs: 1, 31, 10, 0)
libcurl3t64-gnutls
libcurl4-doc
libcurl4-gnutls-dev
libcurl4-openssl-dev (4 bugs: 0, 4, 0, 0)
libcurl4t64

action needed

9 bugs tagged patch in the BTS normal

The BTS contains patches fixing 9 bugs (10 if counting merged bugs), consider including or untagging them.

Created: 2024-02-25 Last update: 2024-12-04 17:30

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2023-03-22 Last update: 2024-12-04 15:03

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit ffa2b55bf292a0b5f8f332871ba59edcd4b54213
Author: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
Date:   Sun Nov 24 00:28:08 2024 -0300

    d/t/control: install curl on upstream-tests-gnutls and remove on openssl

commit e26333770a817937ba2889fe1bcf9150aeba9cf7
Author: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
Date:   Sat Nov 23 23:22:55 2024 -0300

    d/t/upstream-tests-*: test gnutls backend against installed curl
    
    Previously we had curl binary built against libopenssl, but we've
    changed that so our tests must follow the change.

Created: 2024-11-24 Last update: 2024-11-29 09:31

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2024-10-11 Last update: 2024-10-11 18:31

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2024-9681: (needs triaging) When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.

You can find information about how to handle this issue in the security team's documentation.

Created: 2024-11-06 Last update: 2024-11-14 13:30

debian/patches: 6 patches to forward upstream low

Among the 9 debian patches available in version 8.11.0-1 of the package, we noticed the following issues:

6 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-11-10 12:00

testing migrations

This package will soon be part of the auto-openldap transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2024-11-14] Accepted curl 7.74.0-1.3+deb11u14 (source) into oldstable-security (Aquila Macedo Costa) (signed by: Abhijith PA)
[2024-11-13] curl 8.11.0-1 MIGRATED to testing (Debian testing watch)
[2024-11-09] Accepted curl 8.11.0-1 (source) into unstable (Samuel Henrique)
[2024-11-03] Accepted curl 7.88.1-10+deb12u8 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
[2024-10-14] curl 8.10.1-2 MIGRATED to testing (Debian testing watch)
[2024-10-10] Accepted curl 8.10.1-2 (source) into unstable (Samuel Henrique)
[2024-09-28] Accepted curl 8.10.1-1~bpo12+1 (source) into stable-backports (Samuel Henrique)
[2024-09-27] curl 8.10.1-1 MIGRATED to testing (Debian testing watch)
[2024-09-18] Accepted curl 8.10.1-1 (source) into unstable (Samuel Henrique)
[2024-09-12] Accepted curl 8.10.0-2 (source) into unstable (Samuel Henrique)
[2024-09-11] Accepted curl 8.10.0-1 (source) into unstable (Samuel Henrique)
[2024-08-25] Accepted curl 8.9.1-2~bpo12+1 (source) into stable-backports (Samuel Henrique)
[2024-08-24] Accepted curl 7.74.0-1.3+deb11u13 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Carlos Henrique Lima Melara)
[2024-08-23] Accepted curl 7.88.1-10+deb12u7 (source) into proposed-updates (Debian FTP Masters) (signed by: Carlos Henrique Lima Melara)
[2024-08-18] curl 8.9.1-2 MIGRATED to testing (Debian testing watch)
[2024-08-10] Accepted curl 8.9.1-2 (source) into unstable (Carlos Henrique Lima Melara)
[2024-07-31] Accepted curl 8.9.1-1 (source) into unstable (Carlos Henrique Lima Melara)
[2024-07-28] Accepted curl 8.9.0-3 (source) into unstable (Carlos Henrique Lima Melara)
[2024-07-27] Accepted curl 8.9.0-2 (source) into unstable (Carlos Henrique Lima Melara)
[2024-07-26] Accepted curl 8.9.0-1 (source) into unstable (Carlos Henrique Lima Melara)
[2024-07-19] curl 8.8.0-4 MIGRATED to testing (Debian testing watch)
[2024-07-10] Accepted curl 8.8.0-4 (source) into unstable (Samuel Henrique)
[2024-07-07] Accepted curl 8.8.0-3 (source) into unstable (Samuel Henrique)
[2024-07-02] Accepted curl 8.8.0-2 (source) into unstable (Samuel Henrique)
[2024-06-09] Accepted curl 8.8.0-1+exp2 (source) into experimental (Samuel Henrique)
[2024-05-26] curl 8.8.0-1 MIGRATED to testing (Debian testing watch)
[2024-05-26] curl 8.8.0-1 MIGRATED to testing (Debian testing watch)
[2024-05-25] Accepted curl 8.8.0-1+exp1 (source) into experimental (Samuel Henrique)
[2024-05-25] Accepted curl 8.8.0-1~bpo12+1 (source) into stable-backports (Samuel Henrique)
[2024-05-22] Accepted curl 8.8.0-1 (source) into unstable (Samuel Henrique)

bugs [bug history graph]

all: 59 64
RC: 1
I&N: 48 51
M&W: 10 12
F&P: 0
patch: 9 10

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 8.11.0-1ubuntu2
74 bugs (4 patches)
patches for 8.11.0-1ubuntu2