Debian Package Tracker

general

source: passenger (main)
version: 5.0.30-1
maintainer: Debian Ruby Extras Maintainers (archive) [DMD]
uploaders: Felix Geyer [DMD] – Micah Anderson [DMD]
arch: all any
std-ver: 3.9.7
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 5.0.30-1
testing: 5.0.30-1
unstable: 5.0.30-1

versioned links

5.0.30-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libapache2-mod-passenger
passenger
passenger-doc
ruby-passenger
ruby-passenger-doc

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://www.phusionpassenger.com/file_releases failed: 404 Not Found

Created: 2017-11-21 Last update: 2019-02-23 06:07

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2017-16355: In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
CVE-2018-12029: A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

Please fix them.

Created: 2017-11-21 Last update: 2019-02-09 02:06

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2017-16355: In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
CVE-2018-12029: A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

Please fix them.

Created: 2017-11-21 Last update: 2019-02-09 02:06

2 security issues in stretch high

There are 2 open security issues in stretch.

2 important issues:

CVE-2017-16355: In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
CVE-2018-12029: A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

Please fix them.

Created: 2017-11-21 Last update: 2019-02-09 02:06

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 3.9.7).

Created: 2016-04-07 Last update: 2018-12-23 17:15

lintian reports 24 errors and 12 warnings high

Lintian reports 24 errors and 12 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-14 Last update: 2018-09-09 06:37

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2018-10-01 Last update: 2019-02-23 06:14

Depends on packages which need a new maintainer normal

The packages that passenger depends on which need a new maintainer are:

apache2 (#910917)
- Depends: apache2-bin
- Build-Depends: apache2 apache2-dev

Created: 2018-10-12 Last update: 2019-02-23 02:33

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

passenger-doc could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2019-02-23 02:06

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2019-02-22 22:31

1 new commit since last upload, time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 4dd0fc697f4993542e0221c97565ed87b706d3c9
Author: Felix Geyer <fgeyer@debian.org>
Date:   Sun Jun 18 09:59:37 2017 +0200

    Remove myself from Uploaders.

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2017-12-03 Last update: 2019-02-22 12:48

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2018-03-30 Last update: 2018-03-30 01:41

news

[rss feed]

[2016-08-27] passenger 5.0.30-1 MIGRATED to testing (Debian testing watch)
[2016-08-21] Accepted passenger 5.0.30-1 (source) into unstable (Felix Geyer)
[2016-04-13] passenger 5.0.27-2 MIGRATED to testing (Debian testing watch)
[2016-04-07] Accepted passenger 5.0.27-2 (source) into unstable (Felix Geyer)
[2016-04-06] Accepted passenger 5.0.27-1 (source) into unstable (Felix Geyer)
[2016-01-18] Accepted passenger 2.2.11debian-2+deb6u1 (source all i386) into squeeze-lts (Thorsten Alteholz)
[2015-12-13] passenger 5.0.22-1 MIGRATED to testing (Debian testing watch)
[2015-12-07] Accepted passenger 5.0.22-1 (source) into unstable (Felix Geyer)
[2015-09-07] passenger 5.0.7-3 MIGRATED to testing (Britney)
[2015-08-05] Accepted passenger 5.0.7-3 (all source) into unstable (Felix Geyer)
[2015-08-03] Accepted passenger 5.0.7-2 (all source) into unstable (Felix Geyer)
[2015-07-27] Accepted passenger 5.0.7-1 (source amd64 all) into unstable, unstable (Felix Geyer)
[2012-04-03] passenger REMOVED from testing (Debian testing watch)
[2012-03-24] Bug#665444: Removed package(s) from unstable (Debian FTP Masters)
[2010-10-18] passenger 2.2.11debian-2 MIGRATED to testing (Debian testing watch)
[2010-10-07] Accepted passenger 2.2.11debian-2 (source all amd64) (Evgeni Golov) (signed by: Lucas Nussbaum)
[2010-04-04] passenger 2.2.11debian-1 MIGRATED to testing (Debian testing watch)
[2010-03-17] Accepted passenger 2.2.11debian-1 (source all i386) (Micah Anderson)
[2010-02-11] passenger 2.2.9debian-1 MIGRATED to testing (Debian testing watch)
[2010-01-31] Accepted passenger 2.2.9debian-1 (source all i386) (Micah Anderson)
[2009-12-02] passenger 2.2.7debian-1 MIGRATED to testing (Debian testing watch)
[2009-11-20] Accepted passenger 2.2.7debian-1 (source all i386) (Micah Anderson)
[2009-11-09] Accepted passenger 2.2.5debian1-1 (source all i386) (Micah Anderson)
[2009-11-09] Accepted passenger 2.2.5debian-5 (source all i386) (Micah Anderson)
[2009-11-06] Accepted passenger 2.2.5debian-3 (source all i386) (Micah Anderson)
[2009-11-03] Accepted passenger 2.2.5debian-2 (source all i386) (Micah Anderson)
[2009-10-02] passenger 2.2.5debian-1 MIGRATED to testing (Debian testing watch)
[2009-09-18] Accepted passenger 2.2.5debian-1 (source all i386) (Micah Anderson)
[2009-09-09] passenger 2.2.4debian-1 MIGRATED to testing (Debian testing watch)
[2009-08-30] Accepted passenger 2.2.4debian-1 (source all i386) (Micah Anderson)

bugs [bug history graph]

all: 10
RC: 2
I&N: 8
M&W: 0
F&P: 0
patch: 1

links

homepage
lintian (24, 12)
buildd: logs, checks, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.30-1build2
6 bugs