All Debian packages for web servers have to use /var/www as default document root. That's just common best practice, not a vulnerability.
** Changed in: apache2 (Ubuntu)
Status: Unconfirmed => Rejected
--
Default config DocumentRoot points to /var/www/.
https://launchpad.net/bugs/69387
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
