Debian Package Tracker
Register | Log in
Subscribe

ruby-protocol-http1

low level implementation of the HTTP/1 protocol

Choose email to subscribe with

general
  • source: ruby-protocol-http1 (main)
  • version: 0.14.6-1
  • maintainer: Debian Ruby Team (archive) (DMD)
  • uploaders: Hideki Yamane [DMD]
  • arch: all
  • std-ver: 4.6.1
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 0.13.1-1
  • stable: 0.14.6-1
  • unstable: 0.14.6-1
versioned links
  • 0.13.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.14.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • ruby-protocol-http1
action needed
A new upstream version is available: 0.34.0 high
A new upstream version 0.34.0 is available, you should consider packaging it.
Created: 2023-01-31 Last update: 2025-06-09 12:30
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2023-38697: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.
Created: 2023-08-07 Last update: 2025-02-27 19:00
1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:
  • CVE-2023-38697: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.
Created: 2023-08-07 Last update: 2025-02-27 05:02
The package has not entered testing even though the delay is over normal
The package has not entered testing even though the 20-day delay is over. Check why.
Created: 2025-02-27 Last update: 2025-06-09 17:02
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2022-09-18 Last update: 2023-02-02 06:09
1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:
  • CVE-2023-38697: (needs triaging) protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-08-07 Last update: 2025-02-27 19:00
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.6.1).
Created: 2022-12-17 Last update: 2025-02-27 13:25
testing migrations
  • excuses:
    • Migration status for ruby-protocol-http1 (- to 0.14.6-1): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ Updating ruby-protocol-http1 would introduce bugs in testing: #1043432
    • ∙ ∙ blocked by freeze: is not in testing
    • Additional info:
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/r/ruby-protocol-http1.html
    • ∙ ∙ autopkgtest for ruby-protocol-http1/0.14.6-1: amd64: Pass, arm64: Pass, armel: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
    • ∙ ∙ Reproducible on amd64 - info ♻
    • ∙ ∙ Reproducible on arm64 - info ♻
    • ∙ ∙ Reproducible on armhf - info ♻
    • ∙ ∙ Reproducible on i386 - info ♻
    • ∙ ∙ 995 days old (needed 20 days)
    • Not considered
news
[rss feed]
  • [2025-02-28] ruby-protocol-http1 REMOVED from testing (Debian testing watch)
  • [2022-09-21] ruby-protocol-http1 0.14.6-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-17] Accepted ruby-protocol-http1 0.14.6-1 (source) into unstable (Hideki Yamane)
  • [2022-01-11] ruby-protocol-http1 0.14.2-1 MIGRATED to testing (Debian testing watch)
  • [2021-12-02] ruby-protocol-http1 REMOVED from testing (Debian testing watch)
  • [2021-08-28] Accepted ruby-protocol-http1 0.14.2-1 (source) into unstable (Hideki Yamane)
  • [2021-08-21] Accepted ruby-protocol-http1 0.14.1-1 (source) into unstable (Hideki Yamane)
  • [2021-08-21] Accepted ruby-protocol-http1 0.14.0-1 (source) into unstable (Hideki Yamane)
  • [2020-09-28] ruby-protocol-http1 0.13.1-1 MIGRATED to testing (Debian testing watch)
  • [2020-09-26] Accepted ruby-protocol-http1 0.13.1-1 (source) into unstable (Hideki Yamane)
  • [2020-07-09] ruby-protocol-http1 0.13.0-3 MIGRATED to testing (Debian testing watch)
  • [2020-07-03] Accepted ruby-protocol-http1 0.13.0-3 (source) into unstable (Lucas Kanashiro)
  • [2020-06-23] Accepted ruby-protocol-http1 0.13.0-2 (source) into unstable (Hideki Yamane)
  • [2020-06-17] Accepted ruby-protocol-http1 0.13.0-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Hideki Yamane)
  • [2020-06-17] Accepted ruby-protocol-http1 0.12.0-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Hideki Yamane)
bugs [bug history graph]
  • all: 2
  • RC: 1
  • I&N: 0
  • M&W: 1
  • F&P: 0
  • patch: 0
links
  • homepage
  • buildd: logs
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.14.6-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing