Dear security team, ;tl;dr: Should I upload to jessie-security or to jessie-pu?
sitesummary (0.1.17+deb8u2) was uploaded and accepted into jessie-security (without a DSA) to fix #852623, which was caused by DSA-3796-1 for apache2, and which complete broke sitesummary. Sadly that version of sitesummary was also affected by #823688, which breaks sitesummary upgrades, thus the fix for #852623 in jessie-security never reached out users :/ Thus I have prepared 0.1.17+deb8u2 now, fixing #823688, thus also+finally fixing #852623. The only question is: Should I upload to jessie-security or to jessie (so that it gets included in the next point release?) Adam Barrat asked me to ask you and it's entirely my fault to only ask today and not 5 days ago. That said, I'd appreciate a quick answer as the window for the next point release closes this weekend and I'd really like to see sitesummary finally fixed in jessie. :) Oh, the debdiffs are rather trivial: This is what I want to upload now: (happy to change that to jessie-security instead or upload as it is…) $ debdiff sitesummary_0.1.17+deb8u2.dsc sitesummary_0.1.17+deb8u3.dsc diff -Nru sitesummary-0.1.17+deb8u2/debian/changelog sitesummary-0.1.17+deb8u3/debian/changelog --- sitesummary-0.1.17+deb8u2/debian/changelog 2017-03-18 15:26:13.000000000 +0100 +++ sitesummary-0.1.17+deb8u3/debian/changelog 2017-04-21 19:46:46.000000000 +0200 @@ -1,3 +1,11 @@ +sitesummary (0.1.17+deb8u3) jessie; urgency=medium + + [ Wolfgang Schweer ] + * Fix d/sitesummary.prerm and provide mandatory facilities. Cherrypicked from + commit 3cff262 (master branch / 0.1.21 release). (Closes: #823688). + + -- Holger Levsen <[email protected]> Fri, 21 Apr 2017 19:46:35 +0200 + sitesummary (0.1.17+deb8u2) jessie-security; urgency=high * Backport RC fix from unstable. diff -Nru sitesummary-0.1.17+deb8u2/debian/sitesummary.prerm sitesummary-0.1.17+deb8u3/debian/sitesummary.prerm --- sitesummary-0.1.17+deb8u2/debian/sitesummary.prerm 2017-03-18 15:24:14.000000000 +0100 +++ sitesummary-0.1.17+deb8u3/debian/sitesummary.prerm 2017-04-21 19:37:27.000000000 +0200 @@ -12,6 +12,9 @@ apache2_invoke disconf sitesummary.conf fi ;; + deconfigure|upgrade|failed-upgrade) + : + ;; *) echo "prerm called with unknown argument \`$1'" >&2 exit 1 and this is the fix which is still not available to jessie users: $ debdiff sitesummary_0.1.17+deb8u1.dsc sitesummary_0.1.17+deb8u2.dsc diff -Nru sitesummary-0.1.17+deb8u1/debian/changelog sitesummary-0.1.17+deb8u2/debian/changelog --- sitesummary-0.1.17+deb8u1/debian/changelog 2016-02-20 15:24:11.000000000 +0100 +++ sitesummary-0.1.17+deb8u2/debian/changelog 2017-03-18 15:26:13.000000000 +0100 @@ -1,3 +1,13 @@ +sitesummary (0.1.17+deb8u2) jessie-security; urgency=high + + * Backport RC fix from unstable. + + [ Wolfgang Schweer ] + * Adjust sitesummary-upload to use CRLF (\r\n) line endings to be compliant + with apache 2.4.25 security fixes for HTTP requests. (Closes: #852623). + + -- Holger Levsen <[email protected]> Sat, 18 Mar 2017 15:26:10 +0100 + sitesummary (0.1.17+deb8u1) jessie; urgency=medium * Backport RC fixes from unstable. diff -Nru sitesummary-0.1.17+deb8u1/sitesummary-upload sitesummary-0.1.17+deb8u2/sitesummary-upload --- sitesummary-0.1.17+deb8u1/sitesummary-upload 2014-03-31 21:58:06.000000000 +0200 +++ sitesummary-0.1.17+deb8u2/sitesummary-upload 2017-03-18 15:24:19.000000000 +0100 @@ -78,15 +78,13 @@ my $formlen = length($form); #Send data -print $remote <<"EOF"; -POST $submiturl HTTP/1.1 -User-Agent: sitesummary-upload -Host: $host -content-type: multipart/form-data; boundary=$boundary -content-length: $formlen - -$form -EOF +print $remote "POST $submiturl HTTP/1.1\r\n"; +print $remote "User-Agent: sitesummary-upload\r\n"; +print $remote "Host: $host\r\n"; +print $remote "Content-Type: multipart/form-data; boundary=$boundary\r\n"; +print $remote "Content-Length: $formlen\r\n"; +print $remote "\r\n"; +print $remote "$form"; #Get answer my($answer)=""; -- cheers, Holger
signature.asc
Description: Digital signature
