ruby-protocol-http1 - Debian Package Tracker

general

source: ruby-protocol-http1 (main)
version: 0.14.6-1
maintainer: Debian Ruby Team (archive) (DMD)
uploaders: Hideki Yamane [DMD]
arch: all
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.13.1-1
oldstable: 0.14.6-1
unstable: 0.14.6-1

versioned links

0.13.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.14.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-protocol-http1

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:00:27
Last run: 2025-08-27T16:51:15.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:00:31
Last run: 2025-02-20T15:12:28.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:00:23
Last run: 2025-08-11T00:14:48.000Z
Previous status: unknown

Created: 2025-08-11 Last update: 2025-09-19 04:04

A new upstream version is available: 0.35.1 high

A new upstream version 0.35.1 is available, you should consider packaging it.

Created: 2023-01-31 Last update: 2025-09-19 03:02

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2023-38697: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.

Created: 2023-08-07 Last update: 2025-08-10 06:32

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2023-38697: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.

Created: 2023-08-07 Last update: 2025-02-27 05:02

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2025-02-27 Last update: 2025-09-19 04:02

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 392c0d0f6dda76d8fd978ff6f43ea64a8cfa869d
Author: Lucas Nussbaum <lucas@debian.org>
Date:   Tue Sep 9 07:47:37 2025 +0000

    debian/salsa-ci.yml: drop SALSA_CI_DISABLE_BUILD_PACKAGE_ANY (package is Architecture: all anyway)

commit 6407b8ae0e1e975c73ff6d6a031ca205ed2fc5d9
Author: Lucas Nussbaum <lucas@debian.org>
Date:   Mon Sep 8 05:40:23 2025 +0000

    debian/salsa-ci.yml: use team-specific include

commit e66eaa148f525be695867bfe75488f4f134a264f
Author: Lucas Nussbaum <lucas@debian.org>
Date:   Mon Sep 8 05:40:20 2025 +0000

    debian/.gitattributes: remove

commit a14151edffbb8df02a5c9a8ae5618da6b6775a44
Author: Lucas Nussbaum <lucas@debian.org>
Date:   Mon Aug 25 19:44:46 2025 +0000

    debian/gbp.conf: Update for DEP-14

Created: 2025-08-25 Last update: 2025-09-16 19:35

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2022-09-18 Last update: 2023-02-02 06:09

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2023-38697: (needs triaging) protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-08-07 Last update: 2025-08-10 06:32

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.6.1).

Created: 2022-12-17 Last update: 2025-02-27 13:25

testing migrations

excuses:
- Migration status for ruby-protocol-http1 (- to 0.14.6-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating ruby-protocol-http1 would introduce bugs in testing: #1043432
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/r/ruby-protocol-http1.html
- ∙ ∙ autopkgtest for ruby-protocol-http1/0.14.6-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproducible on amd64 - info ♻
- ∙ ∙ Reproducible on arm64 - info ♻
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 1097 days old (needed 2 days)
- Not considered

news

[rss feed]

[2025-02-28] ruby-protocol-http1 REMOVED from testing (Debian testing watch)
[2022-09-21] ruby-protocol-http1 0.14.6-1 MIGRATED to testing (Debian testing watch)
[2022-09-17] Accepted ruby-protocol-http1 0.14.6-1 (source) into unstable (Hideki Yamane)
[2022-01-11] ruby-protocol-http1 0.14.2-1 MIGRATED to testing (Debian testing watch)
[2021-12-02] ruby-protocol-http1 REMOVED from testing (Debian testing watch)
[2021-08-28] Accepted ruby-protocol-http1 0.14.2-1 (source) into unstable (Hideki Yamane)
[2021-08-21] Accepted ruby-protocol-http1 0.14.1-1 (source) into unstable (Hideki Yamane)
[2021-08-21] Accepted ruby-protocol-http1 0.14.0-1 (source) into unstable (Hideki Yamane)
[2020-09-28] ruby-protocol-http1 0.13.1-1 MIGRATED to testing (Debian testing watch)
[2020-09-26] Accepted ruby-protocol-http1 0.13.1-1 (source) into unstable (Hideki Yamane)
[2020-07-09] ruby-protocol-http1 0.13.0-3 MIGRATED to testing (Debian testing watch)
[2020-07-03] Accepted ruby-protocol-http1 0.13.0-3 (source) into unstable (Lucas Kanashiro)
[2020-06-23] Accepted ruby-protocol-http1 0.13.0-2 (source) into unstable (Hideki Yamane)
[2020-06-17] Accepted ruby-protocol-http1 0.13.0-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Hideki Yamane)
[2020-06-17] Accepted ruby-protocol-http1 0.12.0-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Hideki Yamane)

bugs [bug history graph]

all: 2
RC: 1
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.14.6-1