Your message dated Sun, 21 Jul 2013 23:05:25 +0000
with message-id <[email protected]>
and subject line Bug#683255: fixed in squid3 3.3.8-1
has caused the Debian Bug report #683255,
regarding squid3: error page uses external file
http://www.squid-cache.org/Artwork/SN.png
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
683255: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683255
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: squid3
Version: 3.1.6-1.2+squeeze2
Severity: normal
Today I visited
http://bugs.debian.oooooorg/systemd
by accident since the "o" key in my keyboard got stuck. I noticed that
the error page
| ERROR
| The requested URL could not be retrieved
|
| The following error was encountered while trying to retrieve the URL:
http://bugs.debian.oooooorg/systemd
|
| Unable to determine IP address from host name "bugs.debian.oooooorg"
|
| The DNS server returned:
|
| Name Error: The domain name does not exist.
|
| This means that the cache was not able to resolve the hostname presented in
the URL. Check if the address is correct.
|
| Your cache administrator is webmaster.
uses an external image file
http://www.squid-cache.org/Artwork/SN.png. Shouldn't this be included
in /usr/share/squid3/icons? Using external files has at least the
following problems:
1) If squid-cache.org goes down the error pages won't be as pretty :)
2) Fetching external files adds extra latency :)
3) Thanks to the Referer header squid-cache.org can collect list of
typos that people make. This can be an mild privacy issue:
GET /Artwork/SN.png HTTP/1.1
Host: www.squid-cache.org
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.16)
Gecko/20120511 Iceweasel/3.5.16 (like Firefox/3.5.16)
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Referer: http://bugs.debian.oooooorg/systemd
Pragma: no-cache
Via: 1.1 localhost (squid/3.1.6)
X-Forwarded-For: 10.7.6.28
Cache-Control: no-cache
Connection: keep-alive
4) According to http://www.squid-cache.org/Artwork/ the image that is
used is non-free (CC BY-NC-SA 3.0).
More info:
1) This change has been made in the following upstream bzr commit:
revno: 9327
committer: Amos Jeffries <[email protected]>
branch nick: trunk
timestamp: Mon 2008-10-27 19:53:22 +1300
message:
Polish Error Page CSS
Update errorpage.css content to display error pages matched to
squid-cache.org website color scheme and styles including logo.
Add Creative Commons Licence to the CSS file distributed.
Also fix paths for out-of-tree translation.
2) It seems the problem has been noticed elsewhere in the internet but I
couldn't find any reports in bugs.debian.org yet:
http://www.sput.nl/software/squid31.html
http://www.hutsby.net/2011_01_01_archive.html
http://squid-web-proxy-cache.1019090.n4.nabble.com/Squid-3-1-6-tracking-image-td2327795.html
http://www.squid-cache.org/mail-archive/squid-users/201102/0013.html
http://www.squid-cache.org/mail-archive/squid-users/201103/0125.html
3) It seems that SN.png was included to upstream bzr last year:
revno: 11209
committer: Amos Jeffries <[email protected]>
branch nick: trunk
timestamp: Mon 2011-02-07 02:46:38 +1300
message:
Icons Upgrade
This updates the icons from the current anthony-* GIF series to the
completely free PNG silk icons by Mark James.
Why?
* Avoiding GIF format makes Squid just a little bit more FOSS than before.
* These icons are also just a little bit smaller and slicker.
* Distros which package the silk icons separately for other apps can
leverage those packages and share the icons.
Also moves the icons to /var/www/squid/icons in accordance with the
Unix filesystem specs for static web content.
This suggests that SN.png could be free after all? Or maybe upstream
thinks that CC BY-NC-SA 3.0 is free? In any case this needs to be
verified before uploading a new version.
-- System Information:
Debian Release: 6.0.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-0.bpo.2-amd64 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages squid3 depends on:
ii adduser 3.112+nmu2 add and remove users and groups
ii libc6 2.11.3-3 Embedded GNU C Library: Shared lib
ii libcap2 1:2.19-3 support for getting/setting POSIX.
ii libcomerr2 1.41.12-4stable1 common error description library
ii libdb4.8 4.8.30-2 Berkeley v4.8 Database Libraries [
ii libexpat1 2.0.1-7 XML parsing C library - runtime li
ii libgcc1 1:4.4.5-8 GCC support library
ii libgssapi-krb5-2 1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries - k
ii libk5crypto3 1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries - C
ii libkrb5-3 1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries
ii libldap-2.4-2 2.4.23-7.2 OpenLDAP libraries
ii libltdl7 2.2.6b-2 A system independent dlopen wrappe
ii libpam0g 1.1.1-6.1+squeeze1 Pluggable Authentication Modules l
ii libsasl2-2 2.1.23.dfsg1-7 Cyrus SASL - authentication abstra
ii libstdc++6 4.4.5-8 The GNU Standard C++ Library v3
ii libxml2 2.7.8.dfsg-2+squeeze4 GNOME XML library
ii logrotate 3.7.8-6 Log rotation utility
ii lsb-base 3.2-23.2squeeze1 Linux Standard Base 3.2 init scrip
ii netbase 4.45 Basic TCP/IP networking system
ii squid3-common 3.1.6-1.2+squeeze2 A full featured Web Proxy cache (H
squid3 recommends no packages.
Versions of packages squid3 suggests:
pn resolvconf <none> (no description available)
ii smbclient 2:3.5.6~dfsg-3squeeze8 command-line SMB/CIFS clients for
pn squid-cgi <none> (no description available)
pn squidclient <none> (no description available)
-- Configuration Files:
/etc/squid3/squid.conf changed [not included]
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: squid3
Source-Version: 3.3.8-1
We believe that the bug you reported is fixed in the latest version of
squid3, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Luigi Gangitano <[email protected]> (supplier of updated squid3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 21 Jul 2013 18:28:36 +0200
Source: squid3
Binary: squid3 squid3-dbg squid3-common squidclient squid-cgi squid-purge
Architecture: source all i386
Version: 3.3.8-1
Distribution: unstable
Urgency: high
Maintainer: Luigi Gangitano <[email protected]>
Changed-By: Luigi Gangitano <[email protected]>
Description:
squid-cgi - Full featured Web Proxy cache (HTTP proxy) - control CGI
squid-purge - Full featured Web Proxy cache (HTTP proxy) - control utility
squid3 - Full featured Web Proxy cache (HTTP proxy)
squid3-common - Full featured Web Proxy cache (HTTP proxy) - common files
squid3-dbg - Full featured Web Proxy cache (HTTP proxy) - Debug symbols
squidclient - Full featured Web Proxy cache (HTTP proxy) - control utility
Closes: 683255 710126 716743
Changes:
squid3 (3.3.8-1) unstable; urgency=high
.
* Urgency high due to security fixes
.
* New upstream release
- Fixes security issues (Closes: #716743)
+ Buffer overflow in HTTP request handling (Ref: SQUID-2013:2,
CVE-2013-4115)
+ DoS in request processing (Ref: SQUID-2013:3, CVE-2013-4123)
- Includes PNG image used in error pages, with new copyright assignement
(Closes: #683255)
.
* Added /var/run/squid3 dir to host sockets in SMP configuration
(Closes: #710126)
.
* debian/control
- Bumped Standard-Version to 3.9.4, no change needed
Checksums-Sha1:
29b982c82709ef6c54d2de39293a5eef9c54d68e 1530 squid3_3.3.8-1.dsc
127c8252577bce25b62cb0d05b0fef7f3f379c23 2992708 squid3_3.3.8.orig.tar.bz2
35c8e4e202afdd212c93daf8a3227336d13ffbed 21184 squid3_3.3.8-1.debian.tar.gz
970be05ad424d557d29266c23b9c94559dc929e1 248802 squid3-common_3.3.8-1_all.deb
7cb282a4211f18e491ffdd81b50b368f8ce73bca 2336992 squid3_3.3.8-1_i386.deb
336c3a26dab65bc6550dbdf444f6532a395946c7 14453232 squid3-dbg_3.3.8-1_i386.deb
1ce5033441f00cd77e68f2687fc9027cec69cffd 127178 squidclient_3.3.8-1_i386.deb
d4004d225785eab90c30bbe0bb149a475e9a4f7c 130384 squid-cgi_3.3.8-1_i386.deb
813c1e50b323b21922a22f541ccffb55874543ae 119918 squid-purge_3.3.8-1_i386.deb
Checksums-Sha256:
67c2c5358449ad86b055e608a5ce6016c49b696fc38331d0b4a050d56071dd06 1530
squid3_3.3.8-1.dsc
6411f344510e780f9e579851151278e1d02d8fe06a56abb1d97b1c53c61326a1 2992708
squid3_3.3.8.orig.tar.bz2
123074ae98e0e98963be691b2867de470663ac6f90720ba22d012398ae958e78 21184
squid3_3.3.8-1.debian.tar.gz
22918ea8feca205c786edddd75942a394164ca6ec648132d4e756e77e115c4fa 248802
squid3-common_3.3.8-1_all.deb
e38acb63d8abd9e55842a899470e7e71578f02332956a5e2b0d1e203babc59ee 2336992
squid3_3.3.8-1_i386.deb
bb48b464fa32937924d93931e4bc1921f634ade2386ff8d94f1c6820abec8796 14453232
squid3-dbg_3.3.8-1_i386.deb
edfc36b7f07e6408fa02884db934db567051b22350d1e8f079f44035d58a8e2a 127178
squidclient_3.3.8-1_i386.deb
4c45e619d0c29294a873052b8e08253839cfe12351d9a2dcb3ab25800d78d6f5 130384
squid-cgi_3.3.8-1_i386.deb
ed78cbf694de834feee2b9017d0c6439a3e3f3fa96142e25fb87157710c9949c 119918
squid-purge_3.3.8-1_i386.deb
Files:
5457e74de1151bf4de9a63a2dde5a904 1530 web optional squid3_3.3.8-1.dsc
ec1654d28e29bdd2ee342ffb655ecc72 2992708 web optional squid3_3.3.8.orig.tar.bz2
d2b412af22ed83a3421eb1eb87a6c383 21184 web optional
squid3_3.3.8-1.debian.tar.gz
74098a01d5b095badb7cd6be541052e7 248802 web optional
squid3-common_3.3.8-1_all.deb
de8b893ae360d95f65d4728ca6a2dada 2336992 web optional squid3_3.3.8-1_i386.deb
91b6a9ee0c9941f522fde911b510c115 14453232 debug extra
squid3-dbg_3.3.8-1_i386.deb
905f811921f712559887a48f41dabc5f 127178 web optional
squidclient_3.3.8-1_i386.deb
cfdc5dc7b328568fcb403c8f8b45010d 130384 web optional squid-cgi_3.3.8-1_i386.deb
2e3912cf5f9ce2b29e803d8b4fd1483f 119918 web optional
squid-purge_3.3.8-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)
iEYEARECAAYFAlHsZGYACgkQ8ZumGJJMDCbCKQCeIx8yksq/+y25xxDWjNHDEK6e
rowAmwf4eedtcwJqLqqZiuRlBQMJFQmg
=OqMJ
-----END PGP SIGNATURE-----
--- End Message ---
