Debian Package Tracker

general

source: lighttpd (main)
version: 1.4.49-1.1
maintainer: Debian QA Group [DMD]
arch: all any
std-ver: 4.1.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4.31-4+deb7u4
o-o-sec: 1.4.31-4+deb7u5
oldstable: 1.4.35-4+deb8u1
old-sec: 1.4.35-4+deb8u1
stable: 1.4.45-1
testing: 1.4.49-1.1
unstable: 1.4.49-1.1

versioned links

1.4.31-4+deb7u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.31-4+deb7u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.35-4+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.49-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

lighttpd
lighttpd-doc
lighttpd-mod-authn-gssapi
lighttpd-mod-authn-ldap
lighttpd-mod-authn-mysql
lighttpd-mod-cml
lighttpd-mod-geoip
lighttpd-mod-magnet
lighttpd-mod-mysql-vhost
lighttpd-mod-trigger-b4-dl
lighttpd-mod-webdav

action needed

Marked for autoremoval on 22 December: #913249, #913251 high

Version 1.4.49-1.1 of lighttpd is marked for autoremoval from testing on Sat 22 Dec 2018. It is affected by #913249, #913251. The removal of lighttpd will also cause the removal of (transitive) reverse dependencies: gitano, kopano-webapp, kopano-webapp-plugin-files, qgis. You should try to prevent the removal by fixing these RC bugs.

Created: 2018-11-15 Last update: 2018-11-16 05:30

A new upstream version is available: 1.4.51 high

A new upstream version 1.4.51 is available, you should consider packaging it.

Created: 2018-08-14 Last update: 2018-11-16 03:21

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix it.

Created: 2018-11-07 Last update: 2018-11-11 22:10

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix it.

Created: 2018-11-07 Last update: 2018-11-11 22:10

lintian reports 39 errors and 4 warnings high

Lintian reports 39 errors and 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-10-15 08:26

6 bugs tagged patch in the BTS normal

The BTS contains patches fixing 6 bugs (9 if counting merged bugs), consider including or untagging them.

Created: 2018-10-01 Last update: 2018-11-16 05:07

Depends on packages which need a new maintainer normal

The packages that lighttpd depends on which need a new maintainer are:

apache2 (#910917)
- Suggests: apache2-utils

Created: 2018-10-13 Last update: 2018-11-16 04:30

1 new commit since last upload, time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.4.49-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit c464af821a26b149d29752d32417a2a91caa56fe
Author: Ondřej Nový <onovy@debian.org>
Date:   Mon Oct 1 10:13:28 2018 +0200

    d/copyright: Change Format URL to correct one

Created: 2018-10-01 Last update: 2018-11-16 03:07

O: This package has been orphaned and needs a maintainer. normal

This package has been orphaned. This means that it does not have a real maintainer at the moment. Please consider adopting this package if you are interested in it. Please see bug number #898110 for more information.

Created: 2018-05-07 Last update: 2018-05-07 14:03

1 ignored security issue in stretch low

There is 1 open security issue in stretch.

1 issue skipped by the security teams:

CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix it.

Created: 2018-11-07 Last update: 2018-11-11 22:10

2 ignored security issues in jessie low

There are 2 open security issues in jessie.

2 issues skipped by the security teams:

CVE-2015-3200: mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix them.

Created: 2015-07-12 Last update: 2018-11-11 22:10

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.1.3).

Created: 2018-04-16 Last update: 2018-08-26 08:17

news

[rss feed]

[2018-04-05] lighttpd 1.4.49-1.1 MIGRATED to testing (Debian testing watch)
[2018-03-31] Accepted lighttpd 1.4.49-1.1 (source) into unstable (Ximin Luo)
[2018-03-27] lighttpd 1.4.49-1 MIGRATED to testing (Debian testing watch)
[2018-03-21] Accepted lighttpd 1.4.49-1 (source) into unstable (Clint Adams)
[2017-01-29] lighttpd 1.4.45-1 MIGRATED to testing (Debian testing watch)
[2017-01-19] Accepted lighttpd 1.4.45-1 (source) into unstable (Michael Gilbert)
[2017-01-09] Accepted lighttpd 1.4.44-1 (source amd64 all) into unstable (Krzysztof Krzyżaniak (eloy)) (signed by: Krzysztof Krzyżaniak)
[2016-12-31] lighttpd 1.4.43+git20161216-1 MIGRATED to testing (Debian testing watch)
[2016-12-19] Accepted lighttpd 1.4.43+git20161216-1 (source amd64 all) into unstable, unstable (Michael Gilbert)
[2016-11-26] Accepted lighttpd 1.4.43-1 (source) into unstable (Michael Gilbert)
[2016-08-06] Accepted lighttpd 1.4.35-4+deb8u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Santiago R.R.) (signed by: Santiago Ruano Rincón)
[2016-08-02] Accepted lighttpd 1.4.31-4+deb7u5 (source amd64 all) into oldstable (Santiago R.R.) (signed by: Santiago Ruano Rincón)
[2016-02-26] Accepted lighttpd 1.4.31-4+deb7u4 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Markus Koschany)
[2016-01-08] lighttpd 1.4.39-1 MIGRATED to testing (Debian testing watch)
[2016-01-03] Accepted lighttpd 1.4.39-1 (source) into unstable (Michael Gilbert)
[2015-09-11] lighttpd 1.4.37-1 MIGRATED to testing (Britney)
[2015-09-06] Accepted lighttpd 1.4.37-1 (source) into unstable (Michael Gilbert)
[2015-09-01] Accepted lighttpd 1.4.35-4.1 (source) into unstable (gregor herrmann)
[2015-07-25] Accepted lighttpd 1.4.28-2+squeeze1.7 (source amd64 all) into squeeze-lts (Guido Günther)
[2014-11-07] lighttpd 1.4.35-4 MIGRATED to testing (Britney)
[2014-11-02] Accepted lighttpd 1.4.35-4 (source all) into unstable (Michael Gilbert)
[2014-08-23] lighttpd 1.4.35-3 MIGRATED to testing (Britney)
[2014-08-18] Accepted lighttpd 1.4.35-3 (source all) into unstable (Michael Gilbert)
[2014-07-08] Accepted lighttpd 1.4.28-2+squeeze1.6 (source amd64 all) (Michael Gilbert)
[2014-04-11] lighttpd 1.4.35-2 MIGRATED to testing (Debian testing watch)
[2014-04-05] Accepted lighttpd 1.4.35-2 (source amd64 all) (Michael Gilbert)
[2014-03-30] lighttpd 1.4.35-1 MIGRATED to testing (Debian testing watch)
[2014-03-25] Accepted lighttpd 1.4.31-4+deb7u3 (source amd64 all) (Michael Gilbert)
[2014-03-22] Accepted lighttpd 1.4.35-1 (source amd64 all) (Arno Töll)
[2014-03-13] Accepted lighttpd 1.4.33-1+nmu3 (source amd64 all) (Michael Gilbert)

bugs [bug history graph]

all: 23 27
RC: 2
I&N: 16 19
M&W: 5 6
F&P: 0
patch: 6 9

links

homepage
lintian (39, 4)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.49-1.1ubuntu1
39 bugs (3 patches)
patches for 1.4.49-1.1ubuntu1