Le 02/10/2026 à 06:23, Salvatore Bonaccorso a écrit :
Hi Xavier,
On Thu, Oct 01, 2026 at 07:02:40PM +0200, Xavier Guimard wrote:
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:apache2
User: [email protected]
Usertags: pu
[ Reason ]
A lot of low/medium vulnerabilities were published in apache2 version
2.4.69. This project is ~LTS, so we decided to follow upstream changes
We could do this as well via a DSA, but it should be exposed first in
unstable for a while in case of reported regressions.
Btw, I think CVE-2026-59685 should not be listed as this affects only
Apache HTTP Server when using on Windows?
Regards,
Salvatore
Hi Salvatore,
of course I pushed it in unstable first and autopkgtest + reverse
autopkgtests looks good. However as usual we may wait a few days to see
if upstream will publish a release that fixes regressions as usual:
- 2.4.68 (June 11th) fixed 2.4.67 regressions (June 5th)
- 2.4.65 (July 23th 2025) fixed 2.4.64 regressions (July 11th)
- 2.4.62 (July 18th 2024) fixed 2.4.61 regressions (July 3rd)
- ...
A dozen days looks to be a good choice :-)
CVE-2026-59685 removed from d/changelog (commit 24a09c7c)
Best regards,
Xavier
