Debian Package Tracker

general

source: lighttpd (main)
version: 1.4.53-2
maintainer: Debian QA Group [DMD]
arch: all any
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4.31-4+deb7u4
o-o-sec: 1.4.31-4+deb7u5
oldstable: 1.4.35-4+deb8u1
old-sec: 1.4.35-4+deb8u1
stable: 1.4.45-1
testing: 1.4.53-1
unstable: 1.4.53-2

versioned links

1.4.31-4+deb7u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.31-4+deb7u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.35-4+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.53-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.53-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

lighttpd
lighttpd-doc
lighttpd-mod-authn-gssapi
lighttpd-mod-authn-ldap
lighttpd-mod-authn-mysql
lighttpd-mod-authn-pam
lighttpd-mod-authn-sasl
lighttpd-mod-cml
lighttpd-mod-geoip
lighttpd-mod-magnet
lighttpd-mod-mysql-vhost
lighttpd-mod-trigger-b4-dl
lighttpd-mod-vhostdb-dbi
lighttpd-mod-vhostdb-pgsql
lighttpd-mod-webdav
lighttpd-modules-ldap
lighttpd-modules-mysql

action needed

Debci reports failed tests (log) high

Debci reports test failures (log).

The tests ran in 0h 0m 56s

Last run: 2019-02-13 23:56:51

Previous status: pass

Created: 2019-02-14 Last update: 2019-02-18 07:32

lintian reports 10 warnings high

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2019-01-11 06:57

Depends on packages which need a new maintainer normal

The packages that lighttpd depends on which need a new maintainer are:

apache2 (#910917)
- Suggests: apache2-utils

Created: 2018-10-13 Last update: 2019-02-18 07:46

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2018-10-01 Last update: 2019-02-18 07:37

Multiarch hinter reports 3 issue(s) normal

There are issues with the multiarch metadata for this package.

lighttpd-mod-authn-ldap could be marked Multi-Arch: same
lighttpd-mod-authn-mysql could be marked Multi-Arch: same
lighttpd-mod-mysql-vhost could be marked Multi-Arch: same

Created: 2019-01-30 Last update: 2019-02-18 04:11

11 new commits since last upload, time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 4fe50ee63377edf895c1732c61a87b2a790f54b1
Author: Helmut Grohne <helmut.grohne@intenta.de>
Date:   Wed Feb 13 19:42:52 2019 +0100

    release 1.4.53-2 to unstable

commit cb06647b15073d3243fa5fe05286fc49b431b8d4
Merge: c0f7f34 4e8c433
Author: Helmut Grohne <helmut@subdivi.de>
Date:   Wed Feb 13 19:29:34 2019 +0100

    Merge branch gps-guest/master into master
    
    Merge request !10.

commit 4e8c43326708ad7d31f657e5d09a606358933c03
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Fri Feb 8 16:57:22 2019 -0500

    remote dpkg-statoverride from lighttpd.init
    
    For sysvinit, create dirs (as is listed in lighttpd.tmpfiles.conf)

commit 4590678b5f3d949c24c839309aeabe994757626d
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Fri Feb 8 00:44:45 2019 -0500

    use persistent location for db in webdav conf

commit c0f7f34735e59392bf97d2354a954a73dfe24672
Merge: 98c1bf1 fab90df
Author: Helmut Grohne <helmut@subdivi.de>
Date:   Wed Feb 6 07:34:57 2019 +0100

    Merge stbuehler/fix-php-dep into master
    
    Merge request !9.

commit 98c1bf13063b7cc98b082da5a546c7af67e58abe
Author: Helmut Grohne <helmut.grohne@intenta.de>
Date:   Wed Feb 6 07:34:22 2019 +0100

    bump changelog after upload

commit 1eda6967c98ac69d93b61553d588c9e5df6255a9
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Mon Feb 4 08:13:55 2019 -0500

    add paths to lighttpd.tmpfile.conf
    
    Closes: #679854

commit cc955157c97096de86d49050010d0cd661db7b2f
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Mon Feb 4 07:27:05 2019 -0500

    revert previous commit which set Multi-Arch: same

commit 856242cc0e07b3afe17655a5dbc500a3f5ccaa56
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Mon Feb 4 07:02:03 2019 -0500

    Multiarch hinter suggests Multi-Arch: same
    
    lighttpd-mod-authn-ldap could be marked Multi-Arch: same
    lighttpd-mod-authn-mysql could be marked Multi-Arch: same
    lighttpd-mod-mysql-vhost could be marked Multi-Arch: same
    
    Gbp-Dch: Ignore

commit c5033ff77e100fd6a1b2af9fe6be9b0213369510
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Mon Feb 4 06:54:16 2019 -0500

    fix spelling mistake in lighttpd-mod-authn-mysql
    
    Gbp-Dch: Ignore

commit fab90df41b35c25d3c0417b8459af5894c42a389
Author: Stefan Bühler <stbuehler@web.de>
Date:   Sat Feb 2 14:17:30 2019 +0100

    use php-cgi instead of php; allow php5-cgi as alternative for jessie
    
    Gbp-Dch: Short

Created: 2019-02-04 Last update: 2019-02-17 17:09

O: This package has been orphaned and needs a maintainer. normal

This package has been orphaned. This means that it does not have a real maintainer at the moment. Please consider adopting this package if you are interested in it. Please see bug number #898110 for more information.

Created: 2018-05-07 Last update: 2018-05-07 14:03

1 ignored security issue in stretch low

There is 1 open security issue in stretch.

1 issue skipped by the security teams:

CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix it.

Created: 2018-11-07 Last update: 2019-02-14 01:52

2 ignored security issues in jessie low

There are 2 open security issues in jessie.

2 issues skipped by the security teams:

CVE-2015-3200: mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Please fix them.

Created: 2015-07-12 Last update: 2019-02-14 01:52

testing migrations

excuses:
- Too young, only 4 of 10 days old
- Piuparts tested OK - https://piuparts.debian.org/sid/source/l/lighttpd.html
- autopkgtest for lighttpd/1.4.53-2: amd64: Regression ♻
- Not considered

news

[rss feed]

[2019-02-13] Accepted lighttpd 1.4.53-2 (source) into unstable (Helmut Grohne)
[2019-01-30] lighttpd 1.4.53-1 MIGRATED to testing (Debian testing watch)
[2019-01-28] Accepted lighttpd 1.4.53-1 (source) into unstable (Helmut Grohne)
[2019-01-25] Accepted lighttpd 1.4.52-5 (source) into unstable (Helmut Grohne)
[2019-01-24] Accepted lighttpd 1.4.52-4 (source) into unstable (Helmut Grohne)
[2019-01-09] lighttpd 1.4.52-3 MIGRATED to testing (Debian testing watch)
[2019-01-07] Accepted lighttpd 1.4.52-3 (source) into unstable (Helmut Grohne)
[2019-01-05] Accepted lighttpd 1.4.52-2+exp2 (source amd64 all) into experimental, experimental (Helmut Grohne)
[2018-12-19] lighttpd 1.4.52-2 MIGRATED to testing (Debian testing watch)
[2018-12-17] lighttpd 1.4.52-1 MIGRATED to testing (Debian testing watch)
[2018-12-17] lighttpd 1.4.52-1 MIGRATED to testing (Debian testing watch)
[2018-12-16] Accepted lighttpd 1.4.52-2 (source) into unstable (Helmut Grohne)
[2018-12-06] Accepted lighttpd 1.4.52-1 (source) into unstable (Helmut Grohne)
[2018-12-03] Accepted lighttpd 1.4.49-2 (source) into unstable (Ximin Luo)
[2018-04-05] lighttpd 1.4.49-1.1 MIGRATED to testing (Debian testing watch)
[2018-03-31] Accepted lighttpd 1.4.49-1.1 (source) into unstable (Ximin Luo)
[2018-03-27] lighttpd 1.4.49-1 MIGRATED to testing (Debian testing watch)
[2018-03-21] Accepted lighttpd 1.4.49-1 (source) into unstable (Clint Adams)
[2017-01-29] lighttpd 1.4.45-1 MIGRATED to testing (Debian testing watch)
[2017-01-19] Accepted lighttpd 1.4.45-1 (source) into unstable (Michael Gilbert)
[2017-01-09] Accepted lighttpd 1.4.44-1 (source amd64 all) into unstable (Krzysztof Krzyżaniak (eloy)) (signed by: Krzysztof Krzyżaniak)
[2016-12-31] lighttpd 1.4.43+git20161216-1 MIGRATED to testing (Debian testing watch)
[2016-12-19] Accepted lighttpd 1.4.43+git20161216-1 (source amd64 all) into unstable, unstable (Michael Gilbert)
[2016-11-26] Accepted lighttpd 1.4.43-1 (source) into unstable (Michael Gilbert)
[2016-08-06] Accepted lighttpd 1.4.35-4+deb8u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Santiago R.R.) (signed by: Santiago Ruano Rincón)
[2016-08-02] Accepted lighttpd 1.4.31-4+deb7u5 (source amd64 all) into oldstable (Santiago R.R.) (signed by: Santiago Ruano Rincón)
[2016-02-26] Accepted lighttpd 1.4.31-4+deb7u4 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Markus Koschany)
[2016-01-08] lighttpd 1.4.39-1 MIGRATED to testing (Debian testing watch)
[2016-01-03] Accepted lighttpd 1.4.39-1 (source) into unstable (Michael Gilbert)
[2015-09-11] lighttpd 1.4.37-1 MIGRATED to testing (Britney)

bugs [bug history graph]

all: 6
RC: 0
I&N: 2
M&W: 4
F&P: 0
patch: 1

links

homepage
lintian (0, 10)
buildd: logs, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.53-1ubuntu1
40 bugs (3 patches)
patches for 1.4.53-1ubuntu1