Bug#1076225: marked as done (apache2-utils,merecat: install program with same name (htpasswd))

[Debian Bug Tracking System]

Your message dated Mon, 22 Jul 2024 12:49:43 +
with message-id 
and subject line Bug#1076225: fixed in merecat 2.31+git20220513+ds-5
has caused the Debian Bug report #1076225,
regarding apache2-utils,merecat: install program with same name (htpasswd)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1076225: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076225
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apache2-utils,merecat
Control: block 1075856 by -1

Hi,

your packages apache2-utils and merecat both install a program
named "htpasswd", although in different components of the PATH.

As this is confusing and a possible source of bugs, policy bug
#1075856 wants to outlaw this.

Please find a solution for your packages. Ideas:
1) if one of the programs is an internal implementation detail of
the package, install it into a private path in /usr/lib instead.
2) rename one of the programs
3) rename both of the programs
4) given your packages install programs providing similar features,
   maybe Conflicts: is also appropriate.

Thanks,
Chris
--- End Message ---
--- Begin Message ---
Source: merecat
Source-Version: 2.31+git20220513+ds-5
Done: Alex Myczko 

We believe that the bug you reported is fixed in the latest version of
merecat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1076...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alex Myczko  (supplier of updated merecat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Mon, 22 Jul 2024 11:30:38 +
Source: merecat
Architecture: source
Version: 2.31+git20220513+ds-5
Distribution: unstable
Urgency: medium
Maintainer: Joost van Baal-Ilić 
Changed-By: Alex Myczko 
Closes: 1073715 1076225
Changes:
 merecat (2.31+git20220513+ds-5) unstable; urgency=medium
 .
   * Ack NMU.
   * Bump standards version to 4.7.0.
   * d/control:
 - update build depends pkg-config to pkgconf.
 - add apache2-utils to suggests.
   * d/install: updated. (Closes: #1073715)
   * d/rules: do not install htpasswd and htpasswd.1. (Closes: #1076225)
Checksums-Sha1:
 30e2ab2b9e26d7266badf116d30988eaf4885c31 2008 merecat_2.31+git20220513+ds-5.dsc
 c563303032271e0efeed36041afd87731ac3c0b5 3780 
merecat_2.31+git20220513+ds-5.debian.tar.xz
 11496fd35e2d02de20280172dd663ceb3bf7c672 7750 
merecat_2.31+git20220513+ds-5_source.buildinfo
Checksums-Sha256:
 ede712c0f7212e68456dd9c1c68eb96adbb4bb2b21504a1c5296a2c122583cbb 2008 
merecat_2.31+git20220513+ds-5.dsc
 9b9460123f6393665aabc32796a3a3998cea95f561968e6052de0edc9bbd519a 3780 
merecat_2.31+git20220513+ds-5.debian.tar.xz
 d71304be59e80eefde6062d98d55953cb1aa30eb965453e00f6a8c93f026b8da 7750 
merecat_2.31+git20220513+ds-5_source.buildinfo
Files:
 d251b43a8423663a76a2eea04093c5d3 2008 web optional 
merecat_2.31+git20220513+ds-5.dsc
 5d01422b0d3575c2ad2911b6be561ad3 3780 web optional 
merecat_2.31+git20220513+ds-5.debian.tar.xz
 bf058db36138c5e8d6394e14ac155700 7750 web optional 
merecat_2.31+git20220513+ds-5_source.buildinfo

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEtgob82PcExn/Co6JEWhSvN91FcAFAmaeT7kACgkQEWhSvN91
FcAwohAAiNi7h3VgpksTDKfbF2TtUNBFIAHcadv/6FjCKFwVuMbyz3dHbGYTRB3X
aUyjp+rt+fqg5rksHk+vTPleCewgB6t7iLuOEP6I9J9JrdpXp6N2Cr75ebXKhMhM
M/Os5XFmCXmVvFVdN2Bzw5PCqBrgejThklZPOsU1x1pFbFgMV3tT6WdK2ANoJFx9
YLs7v6zFeYzXz5RxaV+aCIY8r3d9jC/DZus+HGpcBF2krPXK10USOdNGunLusUwi
k1cngMJFnfh9TfoFjqF+Azeww2Q5SW3y6OpoH0GyIZzrCOAeFQbfUytPM6nDOdIJ
DEe4qVhT+TYTDKLkzi7HyMx+f3bSQb4LBe4BXT3uvJZBrO5pR05XLqS6iGcI5+LJ
fHcg5dkiWogfsSj+9hzVROO5PUQH0PowdjCHrEmdEAF9Gf0VHDIM1SM1IcvtB82K
pHATpyx4F8ViHqVj5FHZZphTjUkv83sffiTurKA072JIjirKOaD9OAVXeTJMGS+u
Nz3zLhgnuR/DBZirSVWxw0Hqz2AZQUjKhiRWkeoSleWyCA36zkWsWazuCdVpY6K9
6aRZfFAgpMU9kHeS57rH82dlyyWRx2V+NE624mtu6vpZ4GhS3cdNl6g8p+6aA9Si
BPed/BVMT4SgpPsnIAJrjFEh27dAPws3A7JyovxmWQ49FSzzkrE=
=f3my
-END PGP SIGNATURE-



pgpeP45V0S7qM.pgp
Description: PGP signature
--- End Message ---

Bug#1076554: Same here

[Joachim Zobel]

Same here. Big thanks for the workaround.

Processed: bug 1076554 is forwarded to https://bz.apache.org/bugzilla/show_bug.cgi?id=69160

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> forwarded 1076554 https://bz.apache.org/bugzilla/show_bug.cgi?id=69160
Bug #1076554 [apache2] Regression: error parsing URL //: Invalid host/port
Set Bug forwarded-to-address to 
'https://bz.apache.org/bugzilla/show_bug.cgi?id=69160'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1076554: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076554
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1076554: Regression: error parsing URL //: Invalid host/port

[Sylvain Beucler]

Package: apache2
Version: 2.4.61-1~deb12u1
Severity: important

Dear Maintainer,

Following DSA 5729-1 (2.4.61-1~deb12u1), access to Sympa broke.
User error: Bad Request
Log error: AH01059: error parsing URL //: Invalid host/port

I believe the issue is related to this line:
  SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://"
This is the default configuration from the sympa Debian package.

I get the same result when compiling the debdiff from:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076531
(2.4.62)

I can work-around the issue by appending 'localhost':
  SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://localhost"
(but this is still a regression in the stable release :))

-- Package-specific info:

-- System Information:
Debian Release: 12.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-23-cloud-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE 
not set

Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin2.4.62-1~deb12u1~local
ii  apache2-data   2.4.62-1~deb12u1~local
ii  apache2-utils  2.4.62-1~deb12u1~local
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
ii  apache2-suexec-pristine  2.4.62-1~deb12u1~local
pn  www-browser  

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u7
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u6
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.13-1~deb12u1
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
ii  apache2-suexec-pristine  2.4.62-1~deb12u1~local
pn  www-browser  

Versions of packages apache2 is related to:
ii  apache2  2.4.62-1~deb12u1~local
ii  apache2-bin  2.4.62-1~deb12u1~local

-- no debconf information

Processing of apache2_2.4.62-1_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.62-1_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.62-1.dsc
  apache2_2.4.62.orig.tar.gz
  apache2_2.4.62.orig.tar.gz.asc
  apache2_2.4.62-1.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

apache2_2.4.62-1_sourceonly.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Thu, 18 Jul 2024 06:56:52 +0400
Source: apache2
Architecture: source
Version: 2.4.62-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.62-1) unstable; urgency=medium
 .
   * New upstream version 2.4.62 (Closes: CVE-2024-40725, CVE-2024-40898)
Checksums-Sha1: 
 55e59c0cf275e253e5f9dacda4b24235b4d61b3b 3406 apache2_2.4.62-1.dsc
 60fd03e9558c240293372953d9fe01bf74896bb6 9872432 apache2_2.4.62.orig.tar.gz
 198dd91f2a30797a1804043c70923b11a9b9ebf3 833 apache2_2.4.62.orig.tar.gz.asc
 49863667ac434b591732c97572f3c9f110814dee 821508 apache2_2.4.62-1.debian.tar.xz
Checksums-Sha256: 
 f3402309c707a83d4b9a560678d73d1b1b646c8de82239543c7a7c36f6f7c13b 3406 
apache2_2.4.62-1.dsc
 3e2404d762a2da03560d7ada379ba1599d32f04a0d70ad6ff86f44325f2f062d 9872432 
apache2_2.4.62.orig.tar.gz
 7765403a937dacb562a0eb15ed11ba85f703d10c6bb8b5630591d18876975963 833 
apache2_2.4.62.orig.tar.gz.asc
 c9579bb9fc67493f2795b50cc73f5c43f413e9a113640e86f7f621e9f42e8692 821508 
apache2_2.4.62-1.debian.tar.xz
Files: 
 0ce7c146c8c0145f4bb0b9a56ecb952d 3406 httpd optional apache2_2.4.62-1.dsc
 9edaa3bce9534184d505e57d2832b365 9872432 httpd optional 
apache2_2.4.62.orig.tar.gz
 84aecb3166133e56a8cc6d784fc9be64 833 httpd optional 
apache2_2.4.62.orig.tar.gz.asc
 c174c937b72f130f6ffe87e2e12a6a86 821508 httpd optional 
apache2_2.4.62-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaYnbIACgkQ9tdMp8mZ
7ukNFQ//SKDl1RQYwgEbEOSkN7lKfuu6VB4CxdpxDhIXFy4cT5Qmj1mXiE6cBmbl
/7YYKO1k/tsW4Tyr8X2/opBPt/OZpqwUaN3AvR/2QoWkK09EV3vzByfomquzyxcc
pUafLSUmadgXw7JpNjal62PKc5k5BNjQ012A+oe/fYJP4G2MAUxTH9iPM8zXV311
+KEbHyiyHr9B3xoVVIr5+xKE/YZuyVeg4ZauKAfWtvj7Lystljm9c6XN8PIxdQXL
otl10jHeJFKXuDMn8iPOG2OY1QS4DpQQn6Z70XUEfWMStvQ7E3EFMHinseXPnL/G
gDr1/x8GAJqcOWOPuP237TkN1JWseVX8QBnYhP2I3+xUnlLoa4QNBHpecLDb549m
jX3RDR6v9e0kxUz2uXhPbrvE8X8Qku0vBV6CbanC5rYvvkimwKklv9laYxag+K8B
2iJ9I+6heTqmxZehHnwIxYiXiABe3nRJxTEuQhcgWD08+wTetwaDbQ3VlVmhaPrW
sMXE/SgLP5w5xw4MG/uJ2pp7H0EcZh0BwrIVFtLTQkgARizwpaFXzae+yyDPhQF+
RI64uz+9XMp3logBodJdK+2ENtT1bB6l5jq1VCDq37NryIiA7i0gpxla++iYvZUJ
mZPBJK/+Ftzxk1uGgdVS4xRb7ZB/XJzO3/skNK+ApfKOLL+AWvQ=
=K05P
-END PGP SIGNATURE-



pgp2cM4pbUd2k.pgp
Description: PGP signature

apache2_2.4.61-1~deb11u1_sourceonly.changes ACCEPTED into oldstable-proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 07 Jul 2024 16:53:54 +0400
Source: apache2
Architecture: source
Version: 2.4.61-1~deb11u1
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.61-1~deb11u1) bullseye-security; urgency=medium
 .
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573, CVE-2024-39884)
   * Update test framework
   * Unfuzz patches
Checksums-Sha1: 
 d59e355796851ebbac1aefb065049bdd721ffe70 3539 apache2_2.4.61-1~deb11u1.dsc
 4b4843bd0caf8ffcfea8d7218e00a9fc42455264 9857686 apache2_2.4.61.orig.tar.gz
 236edcb1f7905e4fb276402f60b33681127a1db5 833 apache2_2.4.61.orig.tar.gz.asc
 19ac3c9263325a243a2ee057f8bdfbd68eb94b0e 814392 
apache2_2.4.61-1~deb11u1.debian.tar.xz
Checksums-Sha256: 
 db231c294e1398767c9e1b8059f82366a94aaf1a8e69366ac9802de39ffad8c2 3539 
apache2_2.4.61-1~deb11u1.dsc
 ccdc02f78ebf615002dbcab19c8dd9e124b99207b6fed4eecce7562e64c647c9 9857686 
apache2_2.4.61.orig.tar.gz
 83a5d3832cc0ffe838efa1fe86dd759d8a7d733c97dd06a5fb820e4642c7fc1e 833 
apache2_2.4.61.orig.tar.gz.asc
 ac898d028e0570ab379b5532fa6bf2a97b4288ac3305148ca9a32746fa199c5d 814392 
apache2_2.4.61-1~deb11u1.debian.tar.xz
Files: 
 28e863d2d307012642bad82901230dc8 3539 httpd optional 
apache2_2.4.61-1~deb11u1.dsc
 2bca77bb7cd8d73af007d62f5eaf4985 9857686 httpd optional 
apache2_2.4.61.orig.tar.gz
 787e14a0f411491d6566494906e05c00 833 httpd optional 
apache2_2.4.61.orig.tar.gz.asc
 533023abc5dd9c0393e2610c6dd4c6b1 814392 httpd optional 
apache2_2.4.61-1~deb11u1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaKkF8ACgkQ9tdMp8mZ
7ukUnA//aSnLCzdhqSCyP609vqTVFyxbsaS0jSJ3CXtjXgjDjeN+LYUbAtlA+93u
JsyK8h/4BWckpffNgYJa3zDpBv+KID2AUlCm7jCNPP2/sISRPvV8DVejvjH46Md3
ILIbU46e58bNiIkZTZWYcaEFKAjriTEeUunZB00/m049TFk3Egr5rxTrx1Irj9hN
I4yvdP8vfOR0Oi6nqvJOsor/cetjesFH6SxEFQC7H8uL8ckpYpfcO75wf3T1wX6J
i/N4O3/SryNRWiaCsWKTvsfSzV84epZ/fUsjkDXfp13n/P0AURoZ5UNG0lJGPcEK
z5Mfo6nxspyTU9RtjV3K5UQ3r2qZJ5YTzTXK/cyv959t1HNi8sK4PiWNxxH3/g8h
46G+2/BXw5e1M903C3nvYt72DNZWLe2dQO5f6LDykaR85rzVVmzD7JbaEvAV3AHe
Rw7yrDdPKL670PqRfaAkoVDhgOY6f0hvEggKMuZJjfJODiIkuY2IlIx+McgflYRe
GGyu13tkQIWiQ2divu7gzdRGEF5fBJY8pa6Rlkr1DX4B+ezKRgBTDmhZvAMwqpQ7
N/3btbi+tT1jJ0LOZp5N2rdnoKzu+Kck7xpPK4FL/wCrMA983/pEyEc+8oZOt4az
yY1arTsqMQXp/64IOl/z/2o9va4y1MrFpCvEQ9U5Bgtre1dl8ew=
=J1ax
-END PGP SIGNATURE-



pgpDwt27xo4LM.pgp
Description: PGP signature

apache2_2.4.61-1~deb12u1_sourceonly.changes ACCEPTED into proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 07 Jul 2024 16:08:26 +0400
Source: apache2
Architecture: source
Version: 2.4.61-1~deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.61-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573, CVE-2024-39884)
   * Unfuzz patches
Checksums-Sha1: 
 2ed65c1eae26da3e9041b1a00ddefe4b9c5e6df2 3520 apache2_2.4.61-1~deb12u1.dsc
 4b4843bd0caf8ffcfea8d7218e00a9fc42455264 9857686 apache2_2.4.61.orig.tar.gz
 236edcb1f7905e4fb276402f60b33681127a1db5 833 apache2_2.4.61.orig.tar.gz.asc
 32a3b1af8b36e611ca1641a17623d05f0d67db37 819888 
apache2_2.4.61-1~deb12u1.debian.tar.xz
Checksums-Sha256: 
 315e801cb100d0d8155391c077e0756b85d64f7ebe260c897936c16c795d0a44 3520 
apache2_2.4.61-1~deb12u1.dsc
 ccdc02f78ebf615002dbcab19c8dd9e124b99207b6fed4eecce7562e64c647c9 9857686 
apache2_2.4.61.orig.tar.gz
 83a5d3832cc0ffe838efa1fe86dd759d8a7d733c97dd06a5fb820e4642c7fc1e 833 
apache2_2.4.61.orig.tar.gz.asc
 4c8228862e77cb29b84633a98cf61d58e9b8b692a67e41a09bcd5f226d5acfe9 819888 
apache2_2.4.61-1~deb12u1.debian.tar.xz
Files: 
 41d08651708e1d539d07d5f1e9d5c5f7 3520 httpd optional 
apache2_2.4.61-1~deb12u1.dsc
 2bca77bb7cd8d73af007d62f5eaf4985 9857686 httpd optional 
apache2_2.4.61.orig.tar.gz
 787e14a0f411491d6566494906e05c00 833 httpd optional 
apache2_2.4.61.orig.tar.gz.asc
 1663ef4b98ef5e91975e7e09dfae472e 819888 httpd optional 
apache2_2.4.61-1~deb12u1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaKhgYACgkQ9tdMp8mZ
7ukFzQ/6Auvlw/txX4oR02YI0k7e7MpWPEUS+I10jrC16Dq0u86vYSG92vFzhjsD
Qfc7hnYKVv8kKaKgV51vr5/GrZ6l/g0PZq2gdSllfeUgYJW/bsCldsLziIh7NcHB
yByoeaFoh6ZSPr8tx0DanTrJWW53PcyKlqBqq7M8m/KB0u9tjj/K0goc6dRUjnaA
LM6UirwfZvkaAD5Pb8QTCG1heS9WpoR3WjKd11Fe5GW/h7V2vj09PnhIJDqoQZfL
bZO1ODDOPHnOV/6g7oJZmc1FdtBZpYipt7S5PmhOHQ1fWwbB64y+FsGl23mZIJYA
1Mh8gjOV8VBHD/ePG1HwXo43X+BM7VB4HR5g8ll+i2AZzSsil/e4tC8VgA74jeXu
5YXGbcpLSsWShPU22MdKzdAgAvBCMK8xY0k7Jzd8NURKIAM4ZRlsZS4fnXcmVKD3
C479dBvqRBtbaLASoc8I2KIXF4kWu3tUVTpTnBJjoCTKSsXJZPveSSgLkHxrfsTO
7WMgLqVjcJu1smS/ZLyO9ypuocOagjoxACOmmBEmBpVBPgHqKZPY2tngd735CuCc
Tp5JOOJ7Hjxvj944aJJdpi1tyGApXGj2aJ9KUKT3785eTFyUSSxYpmvAJAUJL4To
ajJGuGnod33N8fN5wC752F3HpYpUV8nSYHN+rHKQWEXQbj8U5oI=
=teFA
-END PGP SIGNATURE-



pgpFq_ntjof0a.pgp
Description: PGP signature

Processed: apache2-utils,merecat: install program with same name (htpasswd)

[Debian Bug Tracking System]

Processing control commands:

> block 1075856 by -1
Bug #1075856 [debian-policy] Clarify filename conflicts for programs
1075856 was blocked by: 1076215 1076220 1076221 1076216 1076224 1076219 1076218 
1076222 1076217 1076223
1075856 was not blocking any bugs.
Added blocking bug(s) of 1075856: 1076225

-- 
1075856: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1075856
1076225: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076225
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1076225: apache2-utils,merecat: install program with same name (htpasswd)

[Chris Hofstaedtler]

Package: apache2-utils,merecat
Control: block 1075856 by -1

Hi,

your packages apache2-utils and merecat both install a program
named "htpasswd", although in different components of the PATH.

As this is confusing and a possible source of bugs, policy bug
#1075856 wants to outlaw this.

Please find a solution for your packages. Ideas:
1) if one of the programs is an internal implementation detail of
the package, install it into a private path in /usr/lib instead.
2) rename one of the programs
3) rename both of the programs
4) given your packages install programs providing similar features,
   maybe Conflicts: is also appropriate.

Thanks,
Chris

apache2_2.4.61-1~deb12u1_sourceonly.changes ACCEPTED into proposed-updates->stable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 07 Jul 2024 16:08:26 +0400
Source: apache2
Architecture: source
Version: 2.4.61-1~deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.61-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573, CVE-2024-39884)
   * Unfuzz patches
Checksums-Sha1: 
 2ed65c1eae26da3e9041b1a00ddefe4b9c5e6df2 3520 apache2_2.4.61-1~deb12u1.dsc
 4b4843bd0caf8ffcfea8d7218e00a9fc42455264 9857686 apache2_2.4.61.orig.tar.gz
 236edcb1f7905e4fb276402f60b33681127a1db5 833 apache2_2.4.61.orig.tar.gz.asc
 32a3b1af8b36e611ca1641a17623d05f0d67db37 819888 
apache2_2.4.61-1~deb12u1.debian.tar.xz
Checksums-Sha256: 
 315e801cb100d0d8155391c077e0756b85d64f7ebe260c897936c16c795d0a44 3520 
apache2_2.4.61-1~deb12u1.dsc
 ccdc02f78ebf615002dbcab19c8dd9e124b99207b6fed4eecce7562e64c647c9 9857686 
apache2_2.4.61.orig.tar.gz
 83a5d3832cc0ffe838efa1fe86dd759d8a7d733c97dd06a5fb820e4642c7fc1e 833 
apache2_2.4.61.orig.tar.gz.asc
 4c8228862e77cb29b84633a98cf61d58e9b8b692a67e41a09bcd5f226d5acfe9 819888 
apache2_2.4.61-1~deb12u1.debian.tar.xz
Files: 
 41d08651708e1d539d07d5f1e9d5c5f7 3520 httpd optional 
apache2_2.4.61-1~deb12u1.dsc
 2bca77bb7cd8d73af007d62f5eaf4985 9857686 httpd optional 
apache2_2.4.61.orig.tar.gz
 787e14a0f411491d6566494906e05c00 833 httpd optional 
apache2_2.4.61.orig.tar.gz.asc
 1663ef4b98ef5e91975e7e09dfae472e 819888 httpd optional 
apache2_2.4.61-1~deb12u1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaKhgYACgkQ9tdMp8mZ
7ukFzQ/6Auvlw/txX4oR02YI0k7e7MpWPEUS+I10jrC16Dq0u86vYSG92vFzhjsD
Qfc7hnYKVv8kKaKgV51vr5/GrZ6l/g0PZq2gdSllfeUgYJW/bsCldsLziIh7NcHB
yByoeaFoh6ZSPr8tx0DanTrJWW53PcyKlqBqq7M8m/KB0u9tjj/K0goc6dRUjnaA
LM6UirwfZvkaAD5Pb8QTCG1heS9WpoR3WjKd11Fe5GW/h7V2vj09PnhIJDqoQZfL
bZO1ODDOPHnOV/6g7oJZmc1FdtBZpYipt7S5PmhOHQ1fWwbB64y+FsGl23mZIJYA
1Mh8gjOV8VBHD/ePG1HwXo43X+BM7VB4HR5g8ll+i2AZzSsil/e4tC8VgA74jeXu
5YXGbcpLSsWShPU22MdKzdAgAvBCMK8xY0k7Jzd8NURKIAM4ZRlsZS4fnXcmVKD3
C479dBvqRBtbaLASoc8I2KIXF4kWu3tUVTpTnBJjoCTKSsXJZPveSSgLkHxrfsTO
7WMgLqVjcJu1smS/ZLyO9ypuocOagjoxACOmmBEmBpVBPgHqKZPY2tngd735CuCc
Tp5JOOJ7Hjxvj944aJJdpi1tyGApXGj2aJ9KUKT3785eTFyUSSxYpmvAJAUJL4To
ajJGuGnod33N8fN5wC752F3HpYpUV8nSYHN+rHKQWEXQbj8U5oI=
=teFA
-END PGP SIGNATURE-



pgpVuemywS9Rr.pgp
Description: PGP signature

apache2_2.4.61-1~deb11u1_sourceonly.changes ACCEPTED into oldstable-proposed-updates->oldstable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping oldstable-security to oldstable-proposed-updates.

Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 07 Jul 2024 16:53:54 +0400
Source: apache2
Architecture: source
Version: 2.4.61-1~deb11u1
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.61-1~deb11u1) bullseye-security; urgency=medium
 .
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573, CVE-2024-39884)
   * Update test framework
   * Unfuzz patches
Checksums-Sha1: 
 d59e355796851ebbac1aefb065049bdd721ffe70 3539 apache2_2.4.61-1~deb11u1.dsc
 4b4843bd0caf8ffcfea8d7218e00a9fc42455264 9857686 apache2_2.4.61.orig.tar.gz
 236edcb1f7905e4fb276402f60b33681127a1db5 833 apache2_2.4.61.orig.tar.gz.asc
 19ac3c9263325a243a2ee057f8bdfbd68eb94b0e 814392 
apache2_2.4.61-1~deb11u1.debian.tar.xz
Checksums-Sha256: 
 db231c294e1398767c9e1b8059f82366a94aaf1a8e69366ac9802de39ffad8c2 3539 
apache2_2.4.61-1~deb11u1.dsc
 ccdc02f78ebf615002dbcab19c8dd9e124b99207b6fed4eecce7562e64c647c9 9857686 
apache2_2.4.61.orig.tar.gz
 83a5d3832cc0ffe838efa1fe86dd759d8a7d733c97dd06a5fb820e4642c7fc1e 833 
apache2_2.4.61.orig.tar.gz.asc
 ac898d028e0570ab379b5532fa6bf2a97b4288ac3305148ca9a32746fa199c5d 814392 
apache2_2.4.61-1~deb11u1.debian.tar.xz
Files: 
 28e863d2d307012642bad82901230dc8 3539 httpd optional 
apache2_2.4.61-1~deb11u1.dsc
 2bca77bb7cd8d73af007d62f5eaf4985 9857686 httpd optional 
apache2_2.4.61.orig.tar.gz
 787e14a0f411491d6566494906e05c00 833 httpd optional 
apache2_2.4.61.orig.tar.gz.asc
 533023abc5dd9c0393e2610c6dd4c6b1 814392 httpd optional 
apache2_2.4.61-1~deb11u1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaKkF8ACgkQ9tdMp8mZ
7ukUnA//aSnLCzdhqSCyP609vqTVFyxbsaS0jSJ3CXtjXgjDjeN+LYUbAtlA+93u
JsyK8h/4BWckpffNgYJa3zDpBv+KID2AUlCm7jCNPP2/sISRPvV8DVejvjH46Md3
ILIbU46e58bNiIkZTZWYcaEFKAjriTEeUunZB00/m049TFk3Egr5rxTrx1Irj9hN
I4yvdP8vfOR0Oi6nqvJOsor/cetjesFH6SxEFQC7H8uL8ckpYpfcO75wf3T1wX6J
i/N4O3/SryNRWiaCsWKTvsfSzV84epZ/fUsjkDXfp13n/P0AURoZ5UNG0lJGPcEK
z5Mfo6nxspyTU9RtjV3K5UQ3r2qZJ5YTzTXK/cyv959t1HNi8sK4PiWNxxH3/g8h
46G+2/BXw5e1M903C3nvYt72DNZWLe2dQO5f6LDykaR85rzVVmzD7JbaEvAV3AHe
Rw7yrDdPKL670PqRfaAkoVDhgOY6f0hvEggKMuZJjfJODiIkuY2IlIx+McgflYRe
GGyu13tkQIWiQ2divu7gzdRGEF5fBJY8pa6Rlkr1DX4B+ezKRgBTDmhZvAMwqpQ7
N/3btbi+tT1jJ0LOZp5N2rdnoKzu+Kck7xpPK4FL/wCrMA983/pEyEc+8oZOt4az
yY1arTsqMQXp/64IOl/z/2o9va4y1MrFpCvEQ9U5Bgtre1dl8ew=
=J1ax
-END PGP SIGNATURE-



pgpkzBJ414V6D.pgp
Description: PGP signature

Processing of apache2_2.4.61-1_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.61-1_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.61-1.dsc
  apache2_2.4.61.orig.tar.gz
  apache2_2.4.61.orig.tar.gz.asc
  apache2_2.4.61-1.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

apache2_2.4.61-1_sourceonly.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Wed, 03 Jul 2024 19:22:29 +0400
Source: apache2
Architecture: source
Version: 2.4.61-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Changes:
 apache2 (2.4.61-1) unstable; urgency=medium
 .
   * New upstream version 2.4.61
Checksums-Sha1: 
 d6565e0b196187b09890689dbe2046be3cc2d802 3406 apache2_2.4.61-1.dsc
 4b4843bd0caf8ffcfea8d7218e00a9fc42455264 9857686 apache2_2.4.61.orig.tar.gz
 236edcb1f7905e4fb276402f60b33681127a1db5 833 apache2_2.4.61.orig.tar.gz.asc
 0692f4979a06c367595e49a9238b89644b20c0d7 821328 apache2_2.4.61-1.debian.tar.xz
Checksums-Sha256: 
 4c107e6157c33c7e86465364effe1259c4978aa56020f305f4dc2b701d2fa37d 3406 
apache2_2.4.61-1.dsc
 ccdc02f78ebf615002dbcab19c8dd9e124b99207b6fed4eecce7562e64c647c9 9857686 
apache2_2.4.61.orig.tar.gz
 83a5d3832cc0ffe838efa1fe86dd759d8a7d733c97dd06a5fb820e4642c7fc1e 833 
apache2_2.4.61.orig.tar.gz.asc
 be1ed125586536cffdd9d7c7db05d2445cf916af319879bb6571a7c7a8ab5174 821328 
apache2_2.4.61-1.debian.tar.xz
Files: 
 25f2d170d4f20c365b6f5ab043ad831d 3406 httpd optional apache2_2.4.61-1.dsc
 2bca77bb7cd8d73af007d62f5eaf4985 9857686 httpd optional 
apache2_2.4.61.orig.tar.gz
 787e14a0f411491d6566494906e05c00 833 httpd optional 
apache2_2.4.61.orig.tar.gz.asc
 e199caa476b61948f9dcbf4b8dcab867 821328 httpd optional 
apache2_2.4.61-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaFbtIACgkQ9tdMp8mZ
7ukEaw//TbL1COJMsFqsvAI76qMhEAZ7v4h6KJgum/vR6rvNmKKSld3LZRmdZHe+
JY/lktvtySUlCyedGIrtv0TZ3Nf1ClXsdg7zdv5Vwomn8GzmYUan4Hn3Xa7dFiXw
DcgScw5E7R1tJ/1wF54EjiF6KmRD1cPlDvugg5/QG37SrSAtqXG0qlyQJAqH2h0q
rs+fTrn0yacug04hXX1zYLqdV5RoBP5FJEv4Y0JC5fIOeT4xviAzuePdQVm+yygN
cJTKC5RpFMUk2qorZmP2y8LW6czn/D62O4ZqC2A1+4lH563il55r+PoJrE9bE4/R
8Npx7pXjKaODjfsqO6pFTzjrCt78ws3X6zA1/iY8dc/4BUGsqpNclkxusI1opXTK
YVIFptAgEzQxJr2Pf5IV3Gml0MRlJJDvLlELyVPXM+C+Lyo66cjFpbqUrktqjdrB
89DgZO1XNKBxTZIwzh+2TpUJ62ne/68TlF+qH2QN2fWpqrjrUWoPsik7llvh+tWQ
jttqrn1TLrwAXqhHyGwTIhK+JQv/qaKXnl7EkAGKwqs2s3DuyNZgiXQUusrB61Bg
KpYPNUaTWQ2DsoSmsGmtxvfpm0nFHFrb5Bng6f2MC80mSLBJkpN35Tu0unUdjchW
LORNe+qDCXYROGOuTRtqZPn+euBjBBOAyjVBUe6rY7KW50W3QLE=
=mxxT
-END PGP SIGNATURE-



pgppNYxGz3SKa.pgp
Description: PGP signature

Bug#1074812: apr-util: ftbfs with GCC-14

[Matthias Klose]

Package: src:apr-util
Version: 1.6.3-2
Severity: important
Tags: sid trixie
User: debian-...@lists.debian.org
Usertags: ftbfs-gcc-14

[This bug is targeted to the upcoming trixie release]

Please keep this issue open in the bug tracker for the package it
was filed for.  If a fix in another package is required, please
file a bug for the other package (or clone), and add a block in this
package. Please keep the issue open until the package can be built in
a follow-up test rebuild.

The package fails to build in a test rebuild on at least amd64 with
gcc-14/g++-14, but succeeds to build with gcc-13/g++-13. The
severity of this report will be raised before the trixie release.

The full build log can be found at:
http://qa-logs.debian.net/2024/07/01/apr-util_1.6.3-2_unstable_gccexp.log
The last lines of the build log are at the end of this report.

To build with GCC 14, either set CC=gcc-14 CXX=g++-14 explicitly,
or install the gcc, g++, gfortran, ... packages from experimental.

  apt-get -t=experimental install g++ 

Common build failures are new warnings resulting in build failures with
-Werror turned on, or new/dropped symbols in Debian symbols files.
For other C/C++ related build failures see the porting guide at
http://gcc.gnu.org/gcc-14/porting_to.html

[...]
checking for ldap_start_tls_s in -lldap... yes
checking for ldap_sslinit in -lldap... no
checking for ldapssl_init in -lldap... no
checking for ldapssl_install_routines in -lldap... no
  setting LDADD_ldap to "-lldap -llber"
checking for ber_init in -llber... yes
checking for lber.h... yes
checking for ldap.h... yes
checking for ldap_ssl.h... no
checking for LDAP toolkit... OpenLDAP
checking style of ldap_set_rebind_proc routine... three
checking for gdbm.h... yes
checking for gdbm_open in -lgdbm... yes
checking for Berkeley DB 5.3 in the standard places... 
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb-5.3... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb5-5.3... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb53... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb-5... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb5... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb... no
checking for Berkeley DB 5.3 in /usr/local... 
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb-5.3... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb5-5.3... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb53... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb-5... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb5... no
checking for db53/db.h... no
checking for db5/db.h... no
checking for db.h... yes
checking for -ldb... no
checking for Berkeley DB 5.3 in /usr/local/BerkeleyDB.5.3... directory not found
checking for Berkeley DB 5.3 in /boot/home/config... directory not found
configure: error: Berkeley db5 not found
make[1]: *** [debian/rules:66: override_dh_auto_configure] Error 1
make[1]: Leaving directory '/<>'
make: *** [debian/rules:24: build] Error 2
dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2

Processing of apache2_2.4.60-1_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.60-1_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.60-1.dsc
  apache2_2.4.60.orig.tar.gz
  apache2_2.4.60.orig.tar.gz.asc
  apache2_2.4.60-1.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

Bug#1071705: marked as done (Add UFW profile integration with apache2)

[Debian Bug Tracking System]

Your message dated Mon, 01 Jul 2024 14:36:38 +
with message-id 
and subject line Bug#1071705: fixed in apache2 2.4.60-1
has caused the Debian Bug report #1071705,
regarding Add UFW profile integration with apache2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1071705: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071705
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apache2
Version: 2.4.52-1ubuntu4
Severity: wishlist
Tags: patch

In 2008 Ubuntu implemented[1] an Uncomplicated Firewall (UFW) profile for
Apache2.  To the best I can tell, this has not yet been proposed to
Debian, although Debian does use ufw.

Are ufw profiles of interest to Debian?  If so, would Debian's Apache
maintenace team consider adopting this changeset from Ubuntu?

1:  https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/261198

>From cc0cadcadda2725d7c6a961f221bf643bddf6032 Mon Sep 17 00:00:00 2001
From: Bryce Harrington 
Date: Mon, 18 Jul 2022 17:51:08 -0700
Subject: [PATCH] Add Uncomplicated Firewall (UFW) profiles

---
 debian/apache2-utils.ufw.profile | 14 ++
 debian/apache2.dirs  |  1 +
 debian/apache2.install   |  1 +
 debian/control   |  3 ++-
 4 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 debian/apache2-utils.ufw.profile

diff --git a/debian/apache2-utils.ufw.profile b/debian/apache2-utils.ufw.profile
new file mode 100644
index 0..974a655cd
--- /dev/null
+++ b/debian/apache2-utils.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
diff --git a/debian/apache2.dirs b/debian/apache2.dirs
index 60890130b..1aa6d3c65 100644
--- a/debian/apache2.dirs
+++ b/debian/apache2.dirs
@@ -10,3 +10,4 @@ var/cache/apache2/mod_cache_disk
 var/lib/apache2
 var/log/apache2
 var/www/html
+/etc/ufw/applications.d/apache2
diff --git a/debian/apache2.install b/debian/apache2.install
index b6ad78940..92865fc4e 100644
--- a/debian/apache2.install
+++ b/debian/apache2.install
@@ -8,3 +8,4 @@ debian/config-dir/*.conf			/etc/apache2
 debian/config-dir/envvars			/etc/apache2
 debian/config-dir/magic/etc/apache2
 debian/debhelper/apache2-maintscript-helper	/usr/share/apache2/
+debian/apache2-utils.ufw.profile /etc/ufw/applications.d/
diff --git a/debian/control b/debian/control
index a5d33f22e..87f1833b2 100644
--- a/debian/control
+++ b/debian/control
@@ -43,7 +43,8 @@ Depends: apache2-bin (= ${binary:Version}),
 Recommends: ssl-cert
 Suggests: apache2-doc,
   apache2-suexec-pristine | apache2-suexec-custom,
-  www-browser
+  www-browser,
+  ufw
 Pre-Depends: ${misc:Pre-Depends}
 Provides: httpd,
   httpd-cgi
-- 
2.34.1

--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.60-1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1071...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 01 Jul 2024 18:04:08 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.60-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1071701 1071705
Changes:
 apache2 (2.4.60-1) unstable; urgency=medium
 .
   [ Bastien Roucariès ]
   * Forward port CVE-2023-25690 uwsgi tests
   * Fix depends of uwsgi test
   * Use python3 uwsgi plugin
   * Encode bytes for uwsgi test
 .
   [ Bryce Harrington ]
   * Add UFW profile integration (Closes: #1071705)
 .
   [Chris Murray]
   * Use https instead of http in doc (LP: #2045055)
 .
   [ Yadd ]
   * Bump liblua 

Bug#1071701: marked as done (Please build against lua 5.4 instead of lua 5.3)

[Debian Bug Tracking System]

Your message dated Mon, 01 Jul 2024 14:36:38 +
with message-id 
and subject line Bug#1071701: fixed in apache2 2.4.60-1
has caused the Debian Bug report #1071701,
regarding Please build against lua 5.4 instead of lua 5.3
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1071701: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071701
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apache2
Version: 2.4.52-1
Severity: normal
X-Debbugs-Cc:

Please bump the liblua Build-Dep from liblua5.3-dev to liblua5.4-dev.
In Ubuntu we've verified apache2 builds ok with 5.4, and it looks like
Debian has lua 5.4 in testing now.

(See also Deb #979501 for prior lua bump.)

Thank you,
Bryce
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.60-1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1071...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 01 Jul 2024 18:04:08 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.60-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1071701 1071705
Changes:
 apache2 (2.4.60-1) unstable; urgency=medium
 .
   [ Bastien Roucariès ]
   * Forward port CVE-2023-25690 uwsgi tests
   * Fix depends of uwsgi test
   * Use python3 uwsgi plugin
   * Encode bytes for uwsgi test
 .
   [ Bryce Harrington ]
   * Add UFW profile integration (Closes: #1071705)
 .
   [Chris Murray]
   * Use https instead of http in doc (LP: #2045055)
 .
   [ Yadd ]
   * Bump liblua from liblua5.3-dev to liblua5.4-dev (Closes: #1071701)
   * Update test framework
   * releasing package apache2 version 2.4.59-1~deb12u1
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573)
   * Unfuzz patches
Checksums-Sha1: 
 987661e17da85c1580b7af482a880b43c09a1c9d 3406 apache2_2.4.60-1.dsc
 09ad4301a9e5d839efd6c4a48d4b6201d7e05d51 9856532 apache2_2.4.60.orig.tar.gz
 fff1d5619cf7b5afb026354ef901d727318acfcf 833 apache2_2.4.60.orig.tar.gz.asc
 ba928a1fda594d7b0c5181751bfa5a32dbb07748 821392 apache2_2.4.60-1.debian.tar.xz
Checksums-Sha256: 
 7738c2e9ace35f11154de1a5dccb778632899e8251f003ee6eaafaca3c966bd3 3406 
apache2_2.4.60-1.dsc
 741554b6f608ac5cbe90d4774d1c3ccb0c251eaf1b087bac359f8146e1465e07 9856532 
apache2_2.4.60.orig.tar.gz
 58fa0c3090466bee6fb549c23349ffa8bac6a30c4de32d401fbab9a895217edc 833 
apache2_2.4.60.orig.tar.gz.asc
 161a3ea10530851fd63ee9b8f20886977a5a72d7e198a2ec1dcaf3bba65be1b2 821392 
apache2_2.4.60-1.debian.tar.xz
Files: 
 79d26bae8dc9a3f042e7482ed33d9360 3406 httpd optional apache2_2.4.60-1.dsc
 6c7ac2cdcb3825550e3318b71dc49472 9856532 httpd optional 
apache2_2.4.60.orig.tar.gz
 4146856a1e05d20e6e12595546ee 833 httpd optional 
apache2_2.4.60.orig.tar.gz.asc
 eb8d8d65d4ac18944f11ce10e11a067c 821392 httpd optional 
apache2_2.4.60-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaCuW0ACgkQ9tdMp8mZ
7ukUrg//b/oaPRWq4xwldK2V9tFw/lsd3XsdLYpRTc2sVyrScWgrFUD5dw7xLLzH
nNwrCeLYMDT7puriobyYgDSEeTRa5xWorQdrzx7PcTOxqxVGFZZXsWZchslKTbJO
saceacRaUBmZlyTxledRptf0ErBzwQr/QtfqU8mtQsoVCpouPyLxcuiUZ1hvGGGA
RYh6LyXsHK2E5K9rVUgYaiOlLrl87vHVa9/CTg7R01Gmtp9jzPzs9rT5hW8QythH
VpGNQ2KPhxPEiq7DxOFk4+iZSTa6mpMPI+LIX4+WJFurJWW93vraKJP/1G55m8zv
ghfKCvRN1iF8tOFgDns+KVlWVAfxn2U7B3Mz/KN5ymId3pNGg3TgJpcGqVCoHiwS
8FJm/XLEPvCUE5A6aN0hQpQwlz++D1NyPGcpe8ho9ZjlTzu43NwgYOF2lYsNHNwk
fkhBN/Kmz4xygRts20iODUzxST6co5DlamzEcZ8WPntU74clS1xNQJ4CubhhY83C
jRcOR8nKlF8aaDajLpkSzvFnEkc0eEsIJaI2666OxEzMp+cRggbtKNkf20PTEoN1
9Oh+o+3lFvHkbHOQaOghACuebhRkLk+Z/XcCLICq7e+Hqg+AUp4BH5S3h3UCps+M
vPqR3ot/BilN0d4sKQzeviKcSMD+hBG2Pk0dbejAZ8n9aIOaWE4=
=3niq
-END PGP SIGNATURE-



pgpKqczyrOinS.pgp
Description: PGP signature
--- End Message ---

apache2_2.4.60-1_sourceonly.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 01 Jul 2024 18:04:08 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.60-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1071701 1071705
Changes:
 apache2 (2.4.60-1) unstable; urgency=medium
 .
   [ Bastien Roucariès ]
   * Forward port CVE-2023-25690 uwsgi tests
   * Fix depends of uwsgi test
   * Use python3 uwsgi plugin
   * Encode bytes for uwsgi test
 .
   [ Bryce Harrington ]
   * Add UFW profile integration (Closes: #1071705)
 .
   [Chris Murray]
   * Use https instead of http in doc (LP: #2045055)
 .
   [ Yadd ]
   * Bump liblua from liblua5.3-dev to liblua5.4-dev (Closes: #1071701)
   * Update test framework
   * releasing package apache2 version 2.4.59-1~deb12u1
   * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
 CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
 CVE-2024-38477, CVE-2024-39573)
   * Unfuzz patches
Checksums-Sha1: 
 987661e17da85c1580b7af482a880b43c09a1c9d 3406 apache2_2.4.60-1.dsc
 09ad4301a9e5d839efd6c4a48d4b6201d7e05d51 9856532 apache2_2.4.60.orig.tar.gz
 fff1d5619cf7b5afb026354ef901d727318acfcf 833 apache2_2.4.60.orig.tar.gz.asc
 ba928a1fda594d7b0c5181751bfa5a32dbb07748 821392 apache2_2.4.60-1.debian.tar.xz
Checksums-Sha256: 
 7738c2e9ace35f11154de1a5dccb778632899e8251f003ee6eaafaca3c966bd3 3406 
apache2_2.4.60-1.dsc
 741554b6f608ac5cbe90d4774d1c3ccb0c251eaf1b087bac359f8146e1465e07 9856532 
apache2_2.4.60.orig.tar.gz
 58fa0c3090466bee6fb549c23349ffa8bac6a30c4de32d401fbab9a895217edc 833 
apache2_2.4.60.orig.tar.gz.asc
 161a3ea10530851fd63ee9b8f20886977a5a72d7e198a2ec1dcaf3bba65be1b2 821392 
apache2_2.4.60-1.debian.tar.xz
Files: 
 79d26bae8dc9a3f042e7482ed33d9360 3406 httpd optional apache2_2.4.60-1.dsc
 6c7ac2cdcb3825550e3318b71dc49472 9856532 httpd optional 
apache2_2.4.60.orig.tar.gz
 4146856a1e05d20e6e12595546ee 833 httpd optional 
apache2_2.4.60.orig.tar.gz.asc
 eb8d8d65d4ac18944f11ce10e11a067c 821392 httpd optional 
apache2_2.4.60-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmaCuW0ACgkQ9tdMp8mZ
7ukUrg//b/oaPRWq4xwldK2V9tFw/lsd3XsdLYpRTc2sVyrScWgrFUD5dw7xLLzH
nNwrCeLYMDT7puriobyYgDSEeTRa5xWorQdrzx7PcTOxqxVGFZZXsWZchslKTbJO
saceacRaUBmZlyTxledRptf0ErBzwQr/QtfqU8mtQsoVCpouPyLxcuiUZ1hvGGGA
RYh6LyXsHK2E5K9rVUgYaiOlLrl87vHVa9/CTg7R01Gmtp9jzPzs9rT5hW8QythH
VpGNQ2KPhxPEiq7DxOFk4+iZSTa6mpMPI+LIX4+WJFurJWW93vraKJP/1G55m8zv
ghfKCvRN1iF8tOFgDns+KVlWVAfxn2U7B3Mz/KN5ymId3pNGg3TgJpcGqVCoHiwS
8FJm/XLEPvCUE5A6aN0hQpQwlz++D1NyPGcpe8ho9ZjlTzu43NwgYOF2lYsNHNwk
fkhBN/Kmz4xygRts20iODUzxST6co5DlamzEcZ8WPntU74clS1xNQJ4CubhhY83C
jRcOR8nKlF8aaDajLpkSzvFnEkc0eEsIJaI2666OxEzMp+cRggbtKNkf20PTEoN1
9Oh+o+3lFvHkbHOQaOghACuebhRkLk+Z/XcCLICq7e+Hqg+AUp4BH5S3h3UCps+M
vPqR3ot/BilN0d4sKQzeviKcSMD+hBG2Pk0dbejAZ8n9aIOaWE4=
=3niq
-END PGP SIGNATURE-



pgpex8pGdlQVK.pgp
Description: PGP signature

Bug#1074411: apache2-doc : missing "Alias /manual /usr/share/doc/apache2-doc/manual" in /etc/apache2/apache2.conf

[Mon Compte]

Package: apache2-doc
Version: 2.4.56-1~deb11u2
Severity: normal

Dear Maintainer,

The installation of this package should add the following line in 
/etc/apache2/apache2.conf and restart the Apache2 server:
Alias /manual /usr/share/doc/apache2-doc/manual

Indeed, the standard homepage (http://localhost) of the Apache2 server contains 
a link to manual ("Refer to this for the full documentation. Documentation for 
the web server itself can be found by accessing the manual if the apache2-doc 
package was installed on this server."), but this link points to nothing when 
someone clicks on it.
The alias above gives the solution to this bug.
Can you add that in a new release?
Thanks in advance.


-- System Information:
Debian Release: 11.9
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 
'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-28-amd64 (SMP w/4 CPU threads)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

apache2-doc depends on no packages.

Versions of packages apache2-doc recommends:
ii  apache2  2.4.56-1~deb11u2

apache2-doc suggests no packages.

Bug#1074278: --expiration-day option is wrongly parsed

[Sergio Durigan Junior]

Source: ssl-cert
Version: 1.1.2
Severity: normal
Tags: patch

Dear maintainer,

This is the Debian equivalent of
https://bugs.launchpad.net/ubuntu/+source/ssl-cert/+bug/2069330. When
using make-ssl-cert's --expiration-day option, the code wrongly assigns
to the ${opt_expiration_days} variable the index of the option, instead
of its value.

The fix is simple: we need to use ${OPTARG} instead of ${OPTIND} to
obtain the actual value.

I opened the following MR which contains the proposed fix:

https://salsa.debian.org/apache-team/ssl-cert/-/merge_requests/4

Thanks,

-- 
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF  31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
https://sergiodj.net/


signature.asc
Description: PGP signature

Bug#1072729: Acknowledgement (apache2: misleading comment in default /etc/apache2/apache2.conf about accessibility of root filesystem)

[Oliver Weihe]

Hi again,

similar issue with .htaccess and .htpasswd - a simple symlink and Apache 
happily serves the file(s) so the following lines don't really prevent this.


--- 8< ---
#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#

Require all denied

--- 8< ---

And btw: why not this?
--- 8< ---

--- 8< ---


Regards,
 Oliver

Bug#1072804: mod_autoindex: should default to XHTML and send the charset in the document

[Thorsten Glaser]

Package: apache2
Version: 2.4.59-1~deb11u1
Severity: wishlist
Tags: upstream
X-Debbugs-Cc: t...@mirbsd.de

The W3C validator is not quite happy with the default directory indicēs.

Applying the following change to its config…

-   IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* 
DescriptionWidth=* Charset=UTF-8
+   IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* 
DescriptionWidth=* Charset=UTF-8 XHTML

… makes it a little happier, only one warning left (no HTML
meta element to declare the charset, which would involve
patching the C source to emit…
("\n", 
whateverCharsetVar);
… as well (the whateverCharsetVar is the content of the 「Charset=UTF-8」
config from IndexOptions).


-- Package-specific info:

-- System Information:
Debian Release: 11.9
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 
'oldstable-proposed-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-30-amd64 (SMP w/1 CPU thread)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)

Versions of packages apache2 depends on:
ii  apache2-bin  2.4.59-1~deb11u1
ii  apache2-data 2.4.59-1~deb11u1
ii  apache2-utils2.4.59-1~deb11u1
ii  dpkg 1.20.13
ii  init-system-helpers  1.60
ii  lsb-base 11.1.0
ii  mime-support 3.66
ii  perl 5.32.1-4+deb11u3
ii  procps   2:3.3.17-5

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.0+nmu1

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  lynx [www-browser]   2.9.0rel.1-0.2

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.0-6+deb11u2
ii  libaprutil1  1.6.1-5+deb11u1
ii  libaprutil1-dbd-pgsql1.6.1-5+deb11u1
ii  libaprutil1-dbd-sqlite3  1.6.1-5+deb11u1
ii  libaprutil1-ldap 1.6.1-5+deb11u1
ii  libbrotli1   1.0.9-2+b2
ii  libc62.31-13+deb11u10
ii  libcrypt11:4.4.18-4
ii  libcurl4 7.88.1-10+deb12u5~bpo11+0wtf1
ii  libjansson4  2.13.1-1.1
ii  libldap-2.4-22.4.57+dfsg-3+deb11u1
ii  liblua5.3-0  5.3.3-1.1+deb11u1
ii  libnghttp2-141.43.0-1+deb11u1
ii  libpcre3 2:8.39-13
ii  libssl1.11.1.1w-0+deb11u1
ii  libxml2  2.9.10+dfsg-6.7+deb11u4
ii  perl 5.32.1-4+deb11u3
ii  zlib1g   1:1.2.11.dfsg-2+deb11u2

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  lynx [www-browser]   2.9.0rel.1-0.2

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb11u1
ii  apache2-bin  2.4.59-1~deb11u1

-- Configuration Files:
/etc/apache2/conf-available/charset.conf changed [not included]
/etc/apache2/conf-available/security.conf changed [not included]
/etc/apache2/mods-available/autoindex.conf changed [not included]
/etc/apache2/mods-available/mpm_prefork.conf changed [not included]
/etc/apache2/sites-available/000-default.conf changed [not included]
/etc/apache2/sites-available/default-ssl.conf changed [not included]
/etc/logrotate.d/apache2 changed [not included]

-- no debconf information

Bug#1072737: ssl-cert: expiration-day wrongly handled

[Jean-Philippe]

Package: ssl-cert
Version: 1.1.2
Severity: normal

Dear Maintainer,

expiration-day is wrongly handled, if set it is 3 days instead of the value 
given. In the script ${OPTIND} should be replaced by ${OPTARG}

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-21-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ssl-cert depends on:
ii  adduser3.134
ii  debconf [debconf-2.0]  1.5.82
ii  openssl3.0.11-1~deb12u2

ssl-cert recommends no packages.

ssl-cert suggests no packages.

-- debconf information:
  make-ssl-cert/altname:
  make-ssl-cert/hostname: localhost
  make-ssl-cert/vulnerable_prng:
  make-ssl-cert/title:

Bug#1072729: apache2: misleading comment in default /etc/apache2/apache2.conf about accessibility of root filesystem

[Oliver Weihe]

Package: apache2
Version: 2.4.59-1~deb12u1

Hi,

I *think* the comment above the  directive is misleading in 
the default /etc/apache2/apache2.conf:


--- 8< ---
# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and 
/var/www.

# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.

Options FollowSymLinks
AllowOverride None
Require all denied



AllowOverride None
Require all granted



Options Indexes FollowSymLinks
AllowOverride None
Require all granted

--- 8< ---

Placing a symlink pointing e.g. to /etc in the /var/www/html/ directory 
(e.g. 'ln -s /etc /var/www/html/foo') happily shows the content of /etc/ 
when accessing http:///foo while the comment above 
suggests it doesn't. From apache2 documentation this is expected(?) so I 
think the comment in the configuration file is misleading. I *guess* 
this is not limited to the current version.


Regards,
 Oliver

Processed: Bug#1071705 marked as pending in apache2

[Debian Bug Tracking System]

Processing control commands:

> tag -1 pending
Bug #1071705 [src:apache2] Add UFW profile integration with apache2
Added tag(s) pending.

-- 
1071705: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071705
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: Bug#1071701 marked as pending in apache2

[Debian Bug Tracking System]

Processing control commands:

> tag -1 pending
Bug #1071701 [src:apache2] Please build against lua 5.4 instead of lua 5.3
Added tag(s) pending.

-- 
1071701: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071701
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1071705: Add UFW profile integration with apache2

[Bryce Harrington]

Source: apache2
Version: 2.4.52-1ubuntu4
Severity: wishlist
Tags: patch

In 2008 Ubuntu implemented[1] an Uncomplicated Firewall (UFW) profile for
Apache2.  To the best I can tell, this has not yet been proposed to
Debian, although Debian does use ufw.

Are ufw profiles of interest to Debian?  If so, would Debian's Apache
maintenace team consider adopting this changeset from Ubuntu?

1:  https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/261198

>From cc0cadcadda2725d7c6a961f221bf643bddf6032 Mon Sep 17 00:00:00 2001
From: Bryce Harrington 
Date: Mon, 18 Jul 2022 17:51:08 -0700
Subject: [PATCH] Add Uncomplicated Firewall (UFW) profiles

---
 debian/apache2-utils.ufw.profile | 14 ++
 debian/apache2.dirs  |  1 +
 debian/apache2.install   |  1 +
 debian/control   |  3 ++-
 4 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 debian/apache2-utils.ufw.profile

diff --git a/debian/apache2-utils.ufw.profile b/debian/apache2-utils.ufw.profile
new file mode 100644
index 0..974a655cd
--- /dev/null
+++ b/debian/apache2-utils.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
diff --git a/debian/apache2.dirs b/debian/apache2.dirs
index 60890130b..1aa6d3c65 100644
--- a/debian/apache2.dirs
+++ b/debian/apache2.dirs
@@ -10,3 +10,4 @@ var/cache/apache2/mod_cache_disk
 var/lib/apache2
 var/log/apache2
 var/www/html
+/etc/ufw/applications.d/apache2
diff --git a/debian/apache2.install b/debian/apache2.install
index b6ad78940..92865fc4e 100644
--- a/debian/apache2.install
+++ b/debian/apache2.install
@@ -8,3 +8,4 @@ debian/config-dir/*.conf			/etc/apache2
 debian/config-dir/envvars			/etc/apache2
 debian/config-dir/magic/etc/apache2
 debian/debhelper/apache2-maintscript-helper	/usr/share/apache2/
+debian/apache2-utils.ufw.profile /etc/ufw/applications.d/
diff --git a/debian/control b/debian/control
index a5d33f22e..87f1833b2 100644
--- a/debian/control
+++ b/debian/control
@@ -43,7 +43,8 @@ Depends: apache2-bin (= ${binary:Version}),
 Recommends: ssl-cert
 Suggests: apache2-doc,
   apache2-suexec-pristine | apache2-suexec-custom,
-  www-browser
+  www-browser,
+  ufw
 Pre-Depends: ${misc:Pre-Depends}
 Provides: httpd,
   httpd-cgi
-- 
2.34.1

Bug#1071701: Please build against lua 5.4 instead of lua 5.3

[Bryce Harrington]

Source: apache2
Version: 2.4.52-1
Severity: normal
X-Debbugs-Cc:

Please bump the liblua Build-Dep from liblua5.3-dev to liblua5.4-dev.
In Ubuntu we've verified apache2 builds ok with 5.4, and it looks like
Debian has lua 5.4 in testing now.

(See also Deb #979501 for prior lua bump.)

Thank you,
Bryce

Bug#1071596: marked as done (apache2: envvars evaluates string in conditional instead of testing for empty string)

[Debian Bug Tracking System]

Your message dated Wed, 22 May 2024 13:25:14 -0700
with message-id 

and subject line Re: Bug#1071596: apache2: envvars evaluates string in 
conditional instead of testing for empty string
has caused the Debian Bug report #1071596,
regarding apache2: envvars evaluates string in conditional instead of testing 
for empty string
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1071596: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071596
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apache2
Version: 2.4.59-1~deb12u1
Severity: normal

Dear Maintainer,

`envvars` evaluates string in conditional instead of testing for empty string.

`apachectl` calls `envvars` which shows a syntax error despite working:

 root@nodeo:/etc/letsencrypt# apachectl configtest
 /usr/sbin/apachectl: 6: [: /etc/apache2: unexpected operator
 Syntax OK

If I change this line in `envvars`:

 if [ "${APACHE_CONFDIR}" == "" ]; then
 export APACHE_CONFDIR=/etc/apache2
 fi

to this:

 if [ -z ${APACHE_CONFDIR} ]; then
 export APACHE_CONFDIR=/etc/apache2
 fi

... then it works.

It's trying to evaluate `/etc/apache2` as a command?  Weird.

PATH seems totally normal.

Mark

-- Package-specific info:

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-21-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin2.4.59-1~deb12u1
ii  apache2-data   2.4.59-1~deb12u1
ii  apache2-utils  2.4.59-1~deb12u1
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u7
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u5
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.11-1~deb12u2
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb12u1
ii  apache2-bin  2.4.59-1~deb12u1

-- Configuration Files:
/etc/apache2/apache2.conf changed:
DefaultRuntimeDir ${APACHE_RUN_DIR}
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf

Options FollowSymLinks
AllowOverride None
Require all denied


AllowOverride None
Require all granted


Options Indexes FollowSymLinks
AllowOverride None
Require all granted

AccessFileName .htaccess

Require all denied

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf

/etc/apache2/envvars changed:
unset HOME
if [ -z 

Bug#1071596: apache2: envvars evaluates string in conditional instead of testing for empty string

[Mark Hedges]

Weird.  I'll have to reinstall apache2.  Maybe I edited it long ago to
debug it, forgot a space, and it got stuck by debconf picking my
version on upgrades instead of the package maintainer's.  Thanks.


On Wed, May 22, 2024 at 12:38 PM Stefan Fritsch  wrote:
>
> Hi Mark,
>
> Am 21.05.24 um 22:30 schrieb Mark Hedges:
> > Package: apache2
> > Version: 2.4.59-1~deb12u1
> > Severity: normal
> >
> > Dear Maintainer,
> >
> > `envvars` evaluates string in conditional instead of testing for empty 
> > string.
> >
> > `apachectl` calls `envvars` which shows a syntax error despite working:
> >
> >   root@nodeo:/etc/letsencrypt# apachectl configtest
> >   /usr/sbin/apachectl: 6: [: /etc/apache2: unexpected operator
> >   Syntax OK
> >
> > If I change this line in `envvars`:
> >
> >   if [ "${APACHE_CONFDIR}" == "" ]; then
> >export APACHE_CONFDIR=/etc/apache2
> >   fi
>
> This snippet is not in the original file from the apache2 package.
> Compare to
> https://salsa.debian.org/apache-team/apache2/-/blob/master/debian/config-dir/envvars?ref_type=heads
>
> Either you or some package or script has changed the file. If you have
> etckeeper you could dig in the logs.
>
> Cheers,
> Stefan
>
> >
> > to this:
> >
> >   if [ -z ${APACHE_CONFDIR} ]; then
> >export APACHE_CONFDIR=/etc/apache2
> >   fi
> >
> > ... then it works.
> >
> > It's trying to evaluate `/etc/apache2` as a command?  Weird.
> >
> > PATH seems totally normal.
> >
> > Mark
> >
> > -- Package-specific info:
> >
> > -- System Information:
> > Debian Release: 12.5
> >APT prefers stable-updates
> >APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 
> > 'stable')
> > Architecture: amd64 (x86_64)
> >
> > Kernel: Linux 6.1.0-21-amd64 (SMP w/1 CPU thread; PREEMPT)
> > Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE 
> > not set
> > Shell: /bin/sh linked to /usr/bin/dash
> > Init: systemd (via /run/systemd/system)
> > LSM: AppArmor: enabled
> >
> > Versions of packages apache2 depends on:
> > ii  apache2-bin2.4.59-1~deb12u1
> > ii  apache2-data   2.4.59-1~deb12u1
> > ii  apache2-utils  2.4.59-1~deb12u1
> > ii  init-system-helpers1.65.2
> > ii  lsb-base   11.6
> > ii  media-types10.0.0
> > ii  perl   5.36.0-7+deb12u1
> > ii  procps 2:4.0.2-3
> > ii  sysvinit-utils [lsb-base]  3.06-4
> >
> > Versions of packages apache2 recommends:
> > ii  ssl-cert  1.1.2
> >
> > Versions of packages apache2 suggests:
> > pn  apache2-doc  
> > pn  apache2-suexec-pristine | apache2-suexec-custom  
> > ii  chromium [www-browser]   125.0.6422.60-1~deb12u1
> >
> > Versions of packages apache2-bin depends on:
> > ii  libapr1  1.7.2-3
> > ii  libaprutil1  1.6.3-1
> > ii  libaprutil1-dbd-sqlite3  1.6.3-1
> > ii  libaprutil1-ldap 1.6.3-1
> > ii  libbrotli1   1.0.9-2+b6
> > ii  libc62.36-9+deb12u7
> > ii  libcrypt11:4.4.33-2
> > ii  libcurl4 7.88.1-10+deb12u5
> > ii  libjansson4  2.14-2
> > ii  libldap-2.5-02.5.13+dfsg-5
> > ii  liblua5.3-0  5.3.6-2
> > ii  libnghttp2-141.52.0-1+deb12u1
> > ii  libpcre2-8-0 10.42-1
> > ii  libssl3  3.0.11-1~deb12u2
> > ii  libxml2  2.9.14+dfsg-1.3~deb12u1
> > ii  perl 5.36.0-7+deb12u1
> > ii  zlib1g   1:1.2.13.dfsg-1
> >
> > Versions of packages apache2-bin suggests:
> > pn  apache2-doc  
> > pn  apache2-suexec-pristine | apache2-suexec-custom  
> > ii  chromium [www-browser]   125.0.6422.60-1~deb12u1
> >
> > Versions of packages apache2 is related to:
> > ii  apache2  2.4.59-1~deb12u1
> > ii  apache2-bin  2.4.59-1~deb12u1
> >
> > -- Configuration Files:
> > /etc/apache2/apache2.conf changed:
> > DefaultRuntimeDir ${APACHE_RUN_DIR}
> > PidFile ${APACHE_PID_FILE}
> > Timeout 300
> > KeepAlive On
> > MaxKeepAliveRequests 100
> > KeepAliveTimeout 5
> > User ${APACHE_RUN_USER}
> > Group ${APACHE_RUN_GROUP}
> > HostnameLookups Off
> > ErrorLog ${APACHE_LOG_DIR}/error.log
> > LogLevel warn
> > IncludeOptional mods-enabled/*.load
> > IncludeOptional mods-enabled/*.conf
> > Include ports.conf
> > 
> >   Options FollowSymLinks
> >   AllowOverride None
> >   Require all denied
> > 
> > 
> >   AllowOverride None
> >   Require all granted
> > 
> > 
> >   Options Indexes FollowSymLinks
> >   AllowOverride None
> >   Require all granted
> > 
> > AccessFileName .htaccess
> > 
> >   Require all denied
> > 
> > LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" 
> > \"%{User-Agent}i\"" vhost_combined
> > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
> > combined
> > LogFormat 

Bug#1071596: apache2: envvars evaluates string in conditional instead of testing for empty string

[Stefan Fritsch]

Hi Mark,

Am 21.05.24 um 22:30 schrieb Mark Hedges:

Package: apache2
Version: 2.4.59-1~deb12u1
Severity: normal

Dear Maintainer,

`envvars` evaluates string in conditional instead of testing for empty string.

`apachectl` calls `envvars` which shows a syntax error despite working:

  root@nodeo:/etc/letsencrypt# apachectl configtest
  /usr/sbin/apachectl: 6: [: /etc/apache2: unexpected operator
  Syntax OK

If I change this line in `envvars`:

  if [ "${APACHE_CONFDIR}" == "" ]; then
 export APACHE_CONFDIR=/etc/apache2
  fi


This snippet is not in the original file from the apache2 package. 
Compare to 
https://salsa.debian.org/apache-team/apache2/-/blob/master/debian/config-dir/envvars?ref_type=heads


Either you or some package or script has changed the file. If you have 
etckeeper you could dig in the logs.


Cheers,
Stefan



to this:

  if [ -z ${APACHE_CONFDIR} ]; then
 export APACHE_CONFDIR=/etc/apache2
  fi

... then it works.

It's trying to evaluate `/etc/apache2` as a command?  Weird.

PATH seems totally normal.

Mark

-- Package-specific info:

-- System Information:
Debian Release: 12.5
   APT prefers stable-updates
   APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 
'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-21-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin2.4.59-1~deb12u1
ii  apache2-data   2.4.59-1~deb12u1
ii  apache2-utils  2.4.59-1~deb12u1
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u7
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u5
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.11-1~deb12u2
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb12u1
ii  apache2-bin  2.4.59-1~deb12u1

-- Configuration Files:
/etc/apache2/apache2.conf changed:
DefaultRuntimeDir ${APACHE_RUN_DIR}
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf

Options FollowSymLinks
AllowOverride None
Require all denied


AllowOverride None
Require all granted


Options Indexes FollowSymLinks
AllowOverride None
Require all granted

AccessFileName .htaccess

Require all denied

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf

/etc/apache2/envvars changed:
unset HOME
if [ -z "${APACHE_CONFDIR}" ]; then
export APACHE_CONFDIR=/etc/apache2
fi
if [ "${APACHE_CONFDIR##/etc/apache2-}" != "${APACHE_CONFDIR}" ] ; then
SUFFIX="-${APACHE_CONFDIR##/etc/apache2-}"
else
SUFFIX=
fi
export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data
export APACHE_PID_FILE=/var/run/apache2$SUFFIX/apache2.pid
export APACHE_RUN_DIR=/var/run/apache2$SUFFIX
export APACHE_LOCK_DIR=/var/lock/apache2$SUFFIX
export APACHE_LOG_DIR=/var/log/apache2$SUFFIX
export LANG=C
export LANG


-- no debconf information

Bug#1071596: apache2: envvars evaluates string in conditional instead of testing for empty string

[Mark Hedges]

Package: apache2
Version: 2.4.59-1~deb12u1
Severity: normal

Dear Maintainer,

`envvars` evaluates string in conditional instead of testing for empty string.

`apachectl` calls `envvars` which shows a syntax error despite working:

 root@nodeo:/etc/letsencrypt# apachectl configtest
 /usr/sbin/apachectl: 6: [: /etc/apache2: unexpected operator
 Syntax OK

If I change this line in `envvars`:

 if [ "${APACHE_CONFDIR}" == "" ]; then
 export APACHE_CONFDIR=/etc/apache2
 fi

to this:

 if [ -z ${APACHE_CONFDIR} ]; then
 export APACHE_CONFDIR=/etc/apache2
 fi

... then it works.

It's trying to evaluate `/etc/apache2` as a command?  Weird.

PATH seems totally normal.

Mark

-- Package-specific info:

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-21-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin2.4.59-1~deb12u1
ii  apache2-data   2.4.59-1~deb12u1
ii  apache2-utils  2.4.59-1~deb12u1
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u7
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u5
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.11-1~deb12u2
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   125.0.6422.60-1~deb12u1

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb12u1
ii  apache2-bin  2.4.59-1~deb12u1

-- Configuration Files:
/etc/apache2/apache2.conf changed:
DefaultRuntimeDir ${APACHE_RUN_DIR}
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf

Options FollowSymLinks
AllowOverride None
Require all denied


AllowOverride None
Require all granted


Options Indexes FollowSymLinks
AllowOverride None
Require all granted

AccessFileName .htaccess

Require all denied

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf

/etc/apache2/envvars changed:
unset HOME
if [ -z "${APACHE_CONFDIR}" ]; then
export APACHE_CONFDIR=/etc/apache2
fi
if [ "${APACHE_CONFDIR##/etc/apache2-}" != "${APACHE_CONFDIR}" ] ; then
SUFFIX="-${APACHE_CONFDIR##/etc/apache2-}"
else
SUFFIX=
fi
export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data
export APACHE_PID_FILE=/var/run/apache2$SUFFIX/apache2.pid
export APACHE_RUN_DIR=/var/run/apache2$SUFFIX
export APACHE_LOCK_DIR=/var/lock/apache2$SUFFIX
export APACHE_LOG_DIR=/var/log/apache2$SUFFIX
export LANG=C
export LANG


-- no debconf information

Instalacja pv

[Konrad Zieliński]

Dzień dobry,

czy są Państwo otwarci na niezobowiązującą rozmowę na temat fotowoltaiki?

Jako firma specjalizująca się w instalacji i serwisie najlepszych jakościowo 
paneli słonecznych na rynku chciałbym przedstawić propozycję, jaką wspólnie z 
zespołem przygotowaliśmy dla Państwa obiektu.

Będę wdzięczny za wiadomość od Państwa czy możemy porozmawiać.


Pozdrawiam
Konrad Zieliński

Productes

[Fabio Capo]

Hola,

som el fabricant líder a Europa en la indústria domèstica.

T'interessa ampliar la teva oferta amb accessoris de cuina i productes de 
neteja d'alta qualitat que augmentaran les teves vendes?

Oferim preus a l'engròs atractius, que us permeten aconseguir marges 
satisfactoris.

Vols comprovar què et podem oferir?


Atentamente
Fabio Capo

Bug#1071102: apache2: apache 2.4.59 error of handling HTTPS 100 Continue POST CGI responces

[Andrey A. Moiseenko]

Package: apache2
Version: 2.4.59-1~deb12u1
Severity: normal

Dear Maintainer,

apache 2.4.59 is send correct 100 Continue responce by HTTP, but not by HTTPS.
Sample html POST form is in 100c.htm, sample bash script is in 100c.cgi

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
 ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***


-- Package-specific info:

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-21-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin2.4.59-1~deb12u1
ii  apache2-data   2.4.59-1~deb12u1
ii  apache2-utils  2.4.59-1~deb12u1
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  lynx [www-browser]   2.9.0dev.12-1

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u7
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u5
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.11-1~deb12u2
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  lynx [www-browser]   2.9.0dev.12-1

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb12u1
ii  apache2-bin  2.4.59-1~deb12u1

-- Configuration Files:
/etc/apache2/apache2.conf changed:
ServerRoot "/etc/apache2"
Mutex file:${APACHE_LOCK_DIR} default
DefaultRuntimeDir ${APACHE_RUN_DIR}
PidFile ${APACHE_PID_FILE}
Timeout 300
KeepAlive On
MaxKeepAliveRequests 1000
KeepAliveTimeout 5
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups Off
ErrorLog /var/log/httpd/error.log
LogLevel warn
NoProxy "maasoftware.ru" "192.162.244.247/32" "192.162.244.248/32" 
"[2a13:3d80:0:6::d]/128" "[2a13:3d80:0:6::e]/128"
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

SetHandler application/x-httpd-php

Include ports.conf
AccessFileName .htaccess

Require all denied

LogFormat "%v:%p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
vhost_combined
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" 
combined
LogFormat "%a %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
IncludeOptional conf-enabled/*.conf




ServerAdmin supp...@maasoftware.ru
ServerName maasoftware.ru:80
DocumentRoot "/var/www"

Options FollowSymLinks
AllowOverride None
#Order deny,allow
#Deny from all
Require all denied

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
#   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important.  Please see
# http://httpd.apache.org/docs/2.2/mod/core.html#options
# for more information.
#
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
#   Options FileInfo AuthConfig Limit
#
#
# Controls who can get stuff from this server.
#

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
#   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named 

Bug#1068412: marked as done (apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)

[Debian Bug Tracking System]

Your message dated Sun, 05 May 2024 19:17:41 +
with message-id 
and subject line Bug#1068412: fixed in apache2 2.4.59-1~deb11u1
has caused the Debian Bug report #1068412,
regarding apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apache2
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for apache2.

CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4

CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5

CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
https://www.cve.org/CVERecord?id=CVE-2023-38709

Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1~deb11u1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1068...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:08:04 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb11u1
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb11u1) bullseye-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * Drop 2.4.56-regression patches
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Install NOTICE files
   * Update test framework
   * Refresh patches
Checksums-Sha1:
 b0c553ee2f9076ab255d36f6f77a4155e8f5180d 3539 apache2_2.4.59-1~deb11u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 8d3d9c0ec949faa3683bc395b0955584347323a6 895172 
apache2_2.4.59-1~deb11u1.debian.tar.xz
 651b4de4722fb3cf7331e0df7147738b7015bf89 3308712 
apache2-bin-dbgsym_2.4.59-1~deb11u1_amd64.deb
 46176b8ad83ca0e991d575f498d67871b2c2e1d6 1447660 
apache2-bin_2.4.59-1~deb11u1_amd64.deb
 2cd7eef5039ed029710efc9edb1c8b8d3822381b 160212 
apache2-data_2.4.59-1~deb11u1_all.deb
 7ae879f3f9fd07d0b0faff14e40af9d955e11a3d 374820 
apache2-dev_2.4.59-1~deb11u1_amd64.deb
 

apache2_2.4.59-1~deb11u1_amd64.changes ACCEPTED into oldstable-proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:08:04 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb11u1
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb11u1) bullseye-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * Drop 2.4.56-regression patches
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Install NOTICE files
   * Update test framework
   * Refresh patches
Checksums-Sha1:
 b0c553ee2f9076ab255d36f6f77a4155e8f5180d 3539 apache2_2.4.59-1~deb11u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 8d3d9c0ec949faa3683bc395b0955584347323a6 895172 
apache2_2.4.59-1~deb11u1.debian.tar.xz
 651b4de4722fb3cf7331e0df7147738b7015bf89 3308712 
apache2-bin-dbgsym_2.4.59-1~deb11u1_amd64.deb
 46176b8ad83ca0e991d575f498d67871b2c2e1d6 1447660 
apache2-bin_2.4.59-1~deb11u1_amd64.deb
 2cd7eef5039ed029710efc9edb1c8b8d3822381b 160212 
apache2-data_2.4.59-1~deb11u1_all.deb
 7ae879f3f9fd07d0b0faff14e40af9d955e11a3d 374820 
apache2-dev_2.4.59-1~deb11u1_amd64.deb
 a74bbd0f3c77d93b2933e9a7ca2c4daef09767ae 4085344 
apache2-doc_2.4.59-1~deb11u1_all.deb
 6b04306349ed3dab9a9baae0bb6ecc733d87101e 3148 
apache2-ssl-dev_2.4.59-1~deb11u1_amd64.deb
 592c2db4a61122edf71651806dab471f3c4fd523 12348 
apache2-suexec-custom-dbgsym_2.4.59-1~deb11u1_amd64.deb
 c8d55c5c2d152295a8f052afb4687b4c608010b6 203964 
apache2-suexec-custom_2.4.59-1~deb11u1_amd64.deb
 f15301bcdfa07e497b13d2e2b63f72b8b1b5e8d1 11140 
apache2-suexec-pristine-dbgsym_2.4.59-1~deb11u1_amd64.deb
 32bca066d4c74d879a47c9695eba65305ce40beb 202404 
apache2-suexec-pristine_2.4.59-1~deb11u1_amd64.deb
 c96298d3153025ee40865dc3114cde0cdc768cd2 115748 
apache2-utils-dbgsym_2.4.59-1~deb11u1_amd64.deb
 9d40390c27ffcfb4291074e8da52e85d7c1542a4 271100 
apache2-utils_2.4.59-1~deb11u1_amd64.deb
 b6c21fd9d72ce97e5bed90e742367bd956752d4e 12690 
apache2_2.4.59-1~deb11u1_amd64.buildinfo
 cdb3c0c6f59f347ab1a5a05759bb0da7a886a1fa 283732 
apache2_2.4.59-1~deb11u1_amd64.deb
 dba70fb6f094395bf44685af6de02efbb9112f4b 956 
libapache2-mod-md_2.4.59-1~deb11u1_amd64.deb
 93d5d7eda14453906d757151f463cae78d545069 1136 
libapache2-mod-proxy-uwsgi_2.4.59-1~deb11u1_amd64.deb
Checksums-Sha256:
 778f49efe1aab7caa9446c4027664cbc77c9b54d4f11e69fc1b1e3f4725e8b77 3539 
apache2_2.4.59-1~deb11u1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 04df061eedac33928a93afe996a9839e83a5daddc5ee53088a0bb37090ed9331 895172 
apache2_2.4.59-1~deb11u1.debian.tar.xz
 fde3f605f2591fc8ec3ef50cc3fa13e318060fe51f5fa5253654889a48989c36 3308712 
apache2-bin-dbgsym_2.4.59-1~deb11u1_amd64.deb
 a8b9c67f1f198511d1769ea1d181950c329b82110812515fcc126da12d78ac55 1447660 
apache2-bin_2.4.59-1~deb11u1_amd64.deb
 701dd3e0bae253b68d9ee12165c67557fc9b9bd485c7d6306410754dd5606ddc 160212 
apache2-data_2.4.59-1~deb11u1_all.deb
 81082a7e4bb4a469dba94655c5a28cfa215b1aeb189244066904be9eb3670f4b 374820 
apache2-dev_2.4.59-1~deb11u1_amd64.deb
 364ea71d4666f290d80692d9104e1c021380e677821b15bcdb79888be017261f 4085344 
apache2-doc_2.4.59-1~deb11u1_all.deb
 49a7fd50c283a3a039e59ab3c14702ecb2cff94296ffa9d3bded6ec6cca7c97d 3148 
apache2-ssl-dev_2.4.59-1~deb11u1_amd64.deb
 c31f146feaa81ae84ebeba6509ebf1d9cd55f9c2e8b6a5b1f5d9a5837f0ee5dc 12348 
apache2-suexec-custom-dbgsym_2.4.59-1~deb11u1_amd64.deb
 6c646b06d6187df71e36b5400a7fac1df2e578219e1856e57cd3038a7c65eefb 203964 
apache2-suexec-custom_2.4.59-1~deb11u1_amd64.deb
 c75bcdb70660d6713671ce437f18205c35099b754b608d770c3b780e7c3625df 11140 

Bug#1068412: marked as done (apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)

[Debian Bug Tracking System]

Your message dated Sun, 05 May 2024 18:47:10 +
with message-id 
and subject line Bug#1068412: fixed in apache2 2.4.59-1~deb12u1
has caused the Debian Bug report #1068412,
regarding apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apache2
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for apache2.

CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4

CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5

CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
https://www.cve.org/CVERecord?id=CVE-2023-38709

Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1~deb12u1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1068...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:02:26 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Refresh patches
   * Update test framework
Checksums-Sha1:
 0ff1bbe49e7266429e3ea5f8df651776b961902e 3520 apache2_2.4.59-1~deb12u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 59cd2b140a3e313345acb675f4792a63ecad7403 820804 
apache2_2.4.59-1~deb12u1.debian.tar.xz
 d854f4e07f350cf3b067caf1ed78edbde3c76031 3734744 
apache2-bin-dbgsym_2.4.59-1~deb12u1_amd64.deb
 f6a264c3f91353e88233eaec66f997d86be150ad 1379912 
apache2-bin_2.4.59-1~deb12u1_amd64.deb
 16d3d3d8aa25fea0c7755efc8b9685e70cc70b21 160264 
apache2-data_2.4.59-1~deb12u1_all.deb
 5b643339c2a9ec14872873e41772a91f73031c3d 312108 
apache2-dev_2.4.59-1~deb12u1_amd64.deb
 4ec40752b1f22964802957e6a59187ec7dce83ea 4022328 

apache2_2.4.59-1~deb12u1_amd64.changes ACCEPTED into proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:02:26 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Refresh patches
   * Update test framework
Checksums-Sha1:
 0ff1bbe49e7266429e3ea5f8df651776b961902e 3520 apache2_2.4.59-1~deb12u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 59cd2b140a3e313345acb675f4792a63ecad7403 820804 
apache2_2.4.59-1~deb12u1.debian.tar.xz
 d854f4e07f350cf3b067caf1ed78edbde3c76031 3734744 
apache2-bin-dbgsym_2.4.59-1~deb12u1_amd64.deb
 f6a264c3f91353e88233eaec66f997d86be150ad 1379912 
apache2-bin_2.4.59-1~deb12u1_amd64.deb
 16d3d3d8aa25fea0c7755efc8b9685e70cc70b21 160264 
apache2-data_2.4.59-1~deb12u1_all.deb
 5b643339c2a9ec14872873e41772a91f73031c3d 312108 
apache2-dev_2.4.59-1~deb12u1_amd64.deb
 4ec40752b1f22964802957e6a59187ec7dce83ea 4022328 
apache2-doc_2.4.59-1~deb12u1_all.deb
 b61b2467c5d0e89b06d59ba90bb413fa700f5723 3140 
apache2-ssl-dev_2.4.59-1~deb12u1_amd64.deb
 0fc18949fd895d479f1f033684cfcfeb5385ada9 12392 
apache2-suexec-custom-dbgsym_2.4.59-1~deb12u1_amd64.deb
 9fbc0a9723d878098ad3bb0a713c18e566f3a55f 140492 
apache2-suexec-custom_2.4.59-1~deb12u1_amd64.deb
 58df2e8fa9eaa6086f8af5c5a6952a696143e78f 11204 
apache2-suexec-pristine-dbgsym_2.4.59-1~deb12u1_amd64.deb
 862fdbcbe729237447cbf794dbc93fa4ae332879 138932 
apache2-suexec-pristine_2.4.59-1~deb12u1_amd64.deb
 af62a8fc5d4ed2048c0c11f12593bdcf9c9acb71 115544 
apache2-utils-dbgsym_2.4.59-1~deb12u1_amd64.deb
 a1df0a4b290f1e84ebad028d4c1c9cadf69f6615 207236 
apache2-utils_2.4.59-1~deb12u1_amd64.deb
 a7a7ff8ced36acd0d5e20895158d4fa5158c6613 12377 
apache2_2.4.59-1~deb12u1_amd64.buildinfo
 86fd09720da9d0a8496de23c40260c8e363d89c9 219972 
apache2_2.4.59-1~deb12u1_amd64.deb
 12f47d1cfc23d935ec15347ec919aa43c1441b74 956 
libapache2-mod-md_2.4.59-1~deb12u1_amd64.deb
 03b37e6a4d807ee07c8fdec6151f0d681f64ea48 1136 
libapache2-mod-proxy-uwsgi_2.4.59-1~deb12u1_amd64.deb
Checksums-Sha256:
 7eb35073c03aac9d25b20ca453dd6627ec5089e7e7acdf292c874d3dd283df35 3520 
apache2_2.4.59-1~deb12u1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 89968e0d151fc1db6f826cff0985be8e8fad14516019719fe506e1d1c067ebdd 820804 
apache2_2.4.59-1~deb12u1.debian.tar.xz
 07a2a7ebf64eb2765e0f9a74832b8c2a3d2ad82fea12232c03e76a2303c72f7d 3734744 
apache2-bin-dbgsym_2.4.59-1~deb12u1_amd64.deb
 f1d72c8faa521ac1cbd166d5fa0deff7066949519150e3ba42d04941507d0bd7 1379912 
apache2-bin_2.4.59-1~deb12u1_amd64.deb
 a54966f747c61bff59d1197dd72c582436dd38696d054f5ec38f4ff7d2ae41f9 160264 
apache2-data_2.4.59-1~deb12u1_all.deb
 41e7c068796b5dfbaa6985483171c330655e530b3507b63d7a00b5646513b463 312108 
apache2-dev_2.4.59-1~deb12u1_amd64.deb
 8c6ab968ea42bf4820273329cc3972dfc097ad9eab47013e941de7effa7acc3c 4022328 
apache2-doc_2.4.59-1~deb12u1_all.deb
 f294826ac5db7123a667b3d7048241ffbcb94608ae9658d7f5e611decbcd65ba 3140 
apache2-ssl-dev_2.4.59-1~deb12u1_amd64.deb
 08bf4c363375d78f6c6a2d731e5d6f6f1537aba40f1bc0eb99e820b8c71ea362 12392 
apache2-suexec-custom-dbgsym_2.4.59-1~deb12u1_amd64.deb
 631d97f2123c598f4ac9acb0951dcf518b9d513ed01b372a844a512afd0bd0ac 140492 
apache2-suexec-custom_2.4.59-1~deb12u1_amd64.deb
 fea71c46f48fad02ed5ad060589bcc2cf11fd95ef975e6b0fad11053bbdccfc0 11204 
apache2-suexec-pristine-dbgsym_2.4.59-1~deb12u1_amd64.deb
 

Processed: affects 1069748

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> affects 1069748 + release.debian.org,security.debian.org
Bug #1069748 [apache2] mod_ssl: warning about compilation against OpenSSL 
3.0.13 instead of 3.0.11 on bookworm
Added indication that 1069748 affects release.debian.org and security.debian.org
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1069748: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069748
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processing of apache2_2.4.59-2_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.59-2_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.59-2.dsc
  apache2_2.4.59-2.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

apache2_2.4.59-2_sourceonly.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 29 Apr 2024 21:55:28 +
Source: apache2
Architecture: source
Version: 2.4.59-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Bastien Roucariès 
Changes:
 apache2 (2.4.59-2) unstable; urgency=medium
 .
   * Breaks against fossil due to CVE-2024-24795 follows up
Checksums-Sha1: 
 bf8d373078f7b5cf034aedda8a5b6997189af458 3334 apache2_2.4.59-2.dsc
 8c6da99bd38d61ee9c9ae3f49d2b64b7ca61697f 820572 apache2_2.4.59-2.debian.tar.xz
Checksums-Sha256: 
 65a75220c22025d696d1550b81ce8146f5fac3b9ca554187ea793d50986d75c6 3334 
apache2_2.4.59-2.dsc
 f77aceeb1a88968c0709c3c852dfa492e6c05dc18b7c18b33788a551bb9f3264 820572 
apache2_2.4.59-2.debian.tar.xz
Files: 
 f1ba6185cfcc0c62ba9009b6c41b0061 3334 httpd optional apache2_2.4.59-2.dsc
 40a00c40ebc8626f4c9a4cd0a2ac1834 820572 httpd optional 
apache2_2.4.59-2.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYwl6wACgkQ9tdMp8mZ
7ulS5Q/9FS+u+K8MYvJbalK4PiU6IryelP0pcgUfC1Qk1u2/i3ru0EfpqjoOFaR6
SkOKxMwb3UGzy20MUSiAtiUtYmpN/ik4M8U8zOpebUXISR+1/+b2nuEIYgSCOh8J
NI12kfgjnsiVSTd8+tt1xkJ6Yc/EKDAYs+GJIuLg5JGvnBWXgN8DSBDWi8k6fgS0
bRUu0ytSSec7WeZf76HhXdBO8DK9M8TzLOA0chdXsFfprSgQLONyObsyIUMpHU1o
GQhkc3K0vz/g9ptN13wkee8trSNlcCZXMpAZPxgTmou4cXUvW0To2ncGsPYMXQbU
uOfUJUhwSjbarxhX/wDu5/Wwr6x3/85AIL8dd6a3a41HVCKf98v3RHVjTracKqUE
H3++urv7eSej7xWP0yVfpHmPsDxnNF276s9ySkmqDyfrxcRY8KsyOTgs7uaeygQ5
jAdNZAjHw1/u8g8JLAuPY+xGHLQF42cz4tWblOdYkMrYhlSx1RjNhMb/T7mrarT2
4Kcyok2f953/9zoF01mSinZhwC9lOCCho92jM0FIQz/WXoqZ3SOuX4hL/jojULPD
M/K3NQua8rKg+hkmeEO0Md+N37h95/k9GpSWyUurINayPv8mJ55nr1CnNaE8dKFJ
hoec2Sak5LHIsGFqgw9GM6OZT5zaCcedqF5kFVGx6JH0ZUTNp8s=
=unl2
-END PGP SIGNATURE-



pgpb7NeVVdqrm.pgp
Description: PGP signature

Bug#1069907: dh_apache2: please output reproducible module package pre/post scripts.

[James Addison]

Package: apache2-dev
Severity: wishlist
User: reproducible-bui...@lists.alioth.debian.org
Usertags: randomness
Control: affects -1 mod-mono

Dear Maintainer,

I'm an occasional volunteer contributor to the Reproducible Builds[1] project,
and noticed recently that an Apache webserver module, mod-mono, that depends[2]
on the dh_apache2 debhelper utility from apache2-dev at build-time, failed an
automated Debian reproducibility test[3].

The problem appears to be related to the substitution of a NAMES variable
that appears in the templated pre/post scripts evaluated by dh_apache2; the
templates[4][5][6] are found in the 'apache2' source package.

I don't yet know exactly how the non-deterministic ordering of entries in the
NAMES variable occurs; however the replacement parameters[7] in the
dh_apache2.in script seem relevant, and tracing the creation of those may help.

Producing a value for the NAMES variable deterministically should I believe
allow the mod-mono package -- and any other Debian Apache module packages that
contain more than one named module -- to build reproducibily, in turn enabling
consumers of Debian to reliably rebuild a bit-for-bit identical .deb package
from source.

Regards,
James

[1] - https://reproducible-builds.org/

[2] - https://sources.debian.org/src/mod-mono/3.8-3/debian/control/#L9

[3] - 
https://tests.reproducible-builds.org/debian/rb-pkg/trixie/amd64/diffoscope-results/mod-mono.html

[4] - 
https://sources.debian.org/src/apache2/2.4.58-1/debian/debhelper/postinst-apache2/

[5] - 
https://sources.debian.org/src/apache2/2.4.58-1/debian/debhelper/postrm-apache2/

[6] - 
https://sources.debian.org/src/apache2/2.4.58-1/debian/debhelper/prerm-apache2/

[7] - 
https://sources.debian.org/src/apache2/2.4.58-1/debian/debhelper/dh_apache2.in/#L551

Processed: dh_apache2: please output reproducible module package pre/post scripts.

[Debian Bug Tracking System]

Processing control commands:

> affects -1 mod-mono
Bug #1069907 [apache2-dev] dh_apache2: please output reproducible module 
package pre/post scripts.
Added indication that 1069907 affects mod-mono

-- 
1069907: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069907
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1069748: mod_ssl: warning about compilation against OpenSSL 3.0.13 instead of 3.0.11 on bookworm

[Tomaz Solc]

Package: apache2
Version: 2.4.59-1~deb12u1
Severity: normal
X-Debbugs-Cc: t...@security.debian.org

Dear Maintainer,

I noticed that after a recent security update of apache2 on bookworm
(2.4.57-2 -> 2.4.59-1~deb12u1), the following warning started to appear
in the error.log on every apache2 restart:

[ssl:warn] [pid 1144573:tid 281472850739232] AH01882: Init: this version of 
mod_ssl was compiled against a newer library (OpenSSL 3.0.13 30 Jan 2024 
(OpenSSL 3.0.11 19 Sep 2023), version currently loaded is 0x30B0) - may 
result in undefined or erroneous behavior
[mpm_event:notice] [pid 1144575:tid 281472850739232] AH00489: Apache/2.4.59 
(Debian) mod_fcgid/2.3.9 OpenSSL/3.0.11 configured -- resuming normal operations

Comparing package versions on my system with those listed on
packages.debian.org for bookworm it seems I'm up to date with apache2
and libssl3 (3.0.11-1~deb12u2) packages.

Apart from this warning I haven't noticed any problems so far.

Best regards
Tomaž

-- Package-specific info:

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: arm64 (aarch64)

Kernel: Linux 6.1.0-20-arm64 (SMP w/2 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages apache2 depends on:
ii  apache2-bin2.4.59-1~deb12u1
ii  apache2-data   2.4.59-1~deb12u1
ii  apache2-utils  2.4.59-1~deb12u1
ii  init-system-helpers1.65.2
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
pn  ssl-cert  

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
pn  www-browser  

Versions of packages apache2-bin depends on:
ii  libapr1  1.7.2-3
ii  libaprutil1  1.6.3-1
ii  libaprutil1-dbd-sqlite3  1.6.3-1
ii  libaprutil1-ldap 1.6.3-1
ii  libbrotli1   1.0.9-2+b6
ii  libc62.36-9+deb12u6
ii  libcrypt11:4.4.33-2
ii  libcurl4 7.88.1-10+deb12u5
ii  libjansson4  2.14-2
ii  libldap-2.5-02.5.13+dfsg-5
ii  liblua5.3-0  5.3.6-2
ii  libnghttp2-141.52.0-1+deb12u1
ii  libpcre2-8-0 10.42-1
ii  libssl3  3.0.11-1~deb12u2
ii  libxml2  2.9.14+dfsg-1.3~deb12u1
ii  perl 5.36.0-7+deb12u1
ii  zlib1g   1:1.2.13.dfsg-1

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
pn  www-browser  

Versions of packages apache2 is related to:
ii  apache2  2.4.59-1~deb12u1
ii  apache2-bin  2.4.59-1~deb12u1

-- Configuration Files:
/etc/apache2/apache2.conf changed [not included]
/etc/apache2/conf-available/security.conf changed [not included]
/etc/apache2/sites-available/000-default.conf changed [not included]

-- no debconf information

Bullseyeupdate from 2.4.56-1~deb11u2 to 2.4.59-1~deb11u1

[Andreas Schulz (Fujitsu)]

Good morning,

we installed this update last week on our reverseproxys for our customers.

After the updates were installed customer claims that some of their (really 
really old) clients (Win7, Win8.1 with IE11) cannot connect to the reverseproxy 
site with https anymore. After downgrading apache2 back to 2.4.56 they were 
able to connect again.

We checked the https configuration (strict TLS v1.2) and found that configured 
ciphers weren't allowed anymore. Before the update the ciphers looked like:
  Supported Server Cipher(s):
Preferred TLSv1.3  256 bits  TLS_AES_256_GCM_SHA384Curve 25519 DHE 253
Accepted  TLSv1.3  256 bits  TLS_CHACHA20_POLY1305_SHA256  Curve 25519 DHE 253
Accepted  TLSv1.3  128 bits  TLS_AES_128_GCM_SHA256Curve 25519 DHE 253
Preferred TLSv1.2  256 bits  ECDHE-RSA-AES256-GCM-SHA384   Curve 25519 DHE 253
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256   Curve 25519 DHE 253
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-GCM-SHA384 DHE 3072 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-GCM-SHA256 DHE 3072 bits

After the update:
  Supported Server Cipher(s):
Preferred TLSv1.3  256 bits  TLS_AES_256_GCM_SHA384Curve 25519 DHE 253
Accepted  TLSv1.3  256 bits  TLS_CHACHA20_POLY1305_SHA256  Curve 25519 DHE 253
Accepted  TLSv1.3  128 bits  TLS_AES_128_GCM_SHA256Curve 25519 DHE 253
Preferred TLSv1.2  256 bits  ECDHE-RSA-AES256-GCM-SHA384   Curve 25519 DHE 253
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256   Curve 25519 DHE 253

So you can see the DHE-Ciphers were missing. After searching the internet I 
found https://bz.apache.org/bugzilla/show_bug.cgi?id=68863.

I didn't try the patch but the DH-tipp in the certificate file. After including 
the DH in the certificate the problem was solved.

I think that this patch should be imported in the Debian package? Shall I open 
a bug report? I didn't find anything in the debian-apache bug-database.

Kind regards,

Andreas Schulz
Enterprise & Cyber Security Managed Security 2
Services DACH - Managed Cloud Services

Fujitsu Services GmbH
Konrad-Zuse-Str. 16, 74172, Neckarsulm, Germany
W https://www.fujitsu-services.com

Geschäftsführung: Robert Roiger, Michael Pries, Marcos Sanchez Urstadt, Lars 
Moscherosch 
Eingetragener Sitz: München, Deutschland Registergericht: Amtsgericht München 
Reg.- Nr. HRB 219577

Weitere Informationen: https://fujitsu-services.com/impressum
Datenschutz-Hinweise: https://fujitsu-services.com/datenschutz

apache2_2.4.59-1~deb12u1_amd64.changes ACCEPTED into proposed-updates->stable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:02:26 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Refresh patches
   * Update test framework
Checksums-Sha1:
 0ff1bbe49e7266429e3ea5f8df651776b961902e 3520 apache2_2.4.59-1~deb12u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 59cd2b140a3e313345acb675f4792a63ecad7403 820804 
apache2_2.4.59-1~deb12u1.debian.tar.xz
 d854f4e07f350cf3b067caf1ed78edbde3c76031 3734744 
apache2-bin-dbgsym_2.4.59-1~deb12u1_amd64.deb
 f6a264c3f91353e88233eaec66f997d86be150ad 1379912 
apache2-bin_2.4.59-1~deb12u1_amd64.deb
 16d3d3d8aa25fea0c7755efc8b9685e70cc70b21 160264 
apache2-data_2.4.59-1~deb12u1_all.deb
 5b643339c2a9ec14872873e41772a91f73031c3d 312108 
apache2-dev_2.4.59-1~deb12u1_amd64.deb
 4ec40752b1f22964802957e6a59187ec7dce83ea 4022328 
apache2-doc_2.4.59-1~deb12u1_all.deb
 b61b2467c5d0e89b06d59ba90bb413fa700f5723 3140 
apache2-ssl-dev_2.4.59-1~deb12u1_amd64.deb
 0fc18949fd895d479f1f033684cfcfeb5385ada9 12392 
apache2-suexec-custom-dbgsym_2.4.59-1~deb12u1_amd64.deb
 9fbc0a9723d878098ad3bb0a713c18e566f3a55f 140492 
apache2-suexec-custom_2.4.59-1~deb12u1_amd64.deb
 58df2e8fa9eaa6086f8af5c5a6952a696143e78f 11204 
apache2-suexec-pristine-dbgsym_2.4.59-1~deb12u1_amd64.deb
 862fdbcbe729237447cbf794dbc93fa4ae332879 138932 
apache2-suexec-pristine_2.4.59-1~deb12u1_amd64.deb
 af62a8fc5d4ed2048c0c11f12593bdcf9c9acb71 115544 
apache2-utils-dbgsym_2.4.59-1~deb12u1_amd64.deb
 a1df0a4b290f1e84ebad028d4c1c9cadf69f6615 207236 
apache2-utils_2.4.59-1~deb12u1_amd64.deb
 a7a7ff8ced36acd0d5e20895158d4fa5158c6613 12377 
apache2_2.4.59-1~deb12u1_amd64.buildinfo
 86fd09720da9d0a8496de23c40260c8e363d89c9 219972 
apache2_2.4.59-1~deb12u1_amd64.deb
 12f47d1cfc23d935ec15347ec919aa43c1441b74 956 
libapache2-mod-md_2.4.59-1~deb12u1_amd64.deb
 03b37e6a4d807ee07c8fdec6151f0d681f64ea48 1136 
libapache2-mod-proxy-uwsgi_2.4.59-1~deb12u1_amd64.deb
Checksums-Sha256:
 7eb35073c03aac9d25b20ca453dd6627ec5089e7e7acdf292c874d3dd283df35 3520 
apache2_2.4.59-1~deb12u1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 89968e0d151fc1db6f826cff0985be8e8fad14516019719fe506e1d1c067ebdd 820804 
apache2_2.4.59-1~deb12u1.debian.tar.xz
 07a2a7ebf64eb2765e0f9a74832b8c2a3d2ad82fea12232c03e76a2303c72f7d 3734744 
apache2-bin-dbgsym_2.4.59-1~deb12u1_amd64.deb
 f1d72c8faa521ac1cbd166d5fa0deff7066949519150e3ba42d04941507d0bd7 1379912 
apache2-bin_2.4.59-1~deb12u1_amd64.deb
 a54966f747c61bff59d1197dd72c582436dd38696d054f5ec38f4ff7d2ae41f9 160264 
apache2-data_2.4.59-1~deb12u1_all.deb
 41e7c068796b5dfbaa6985483171c330655e530b3507b63d7a00b5646513b463 312108 
apache2-dev_2.4.59-1~deb12u1_amd64.deb
 8c6ab968ea42bf4820273329cc3972dfc097ad9eab47013e941de7effa7acc3c 4022328 
apache2-doc_2.4.59-1~deb12u1_all.deb
 f294826ac5db7123a667b3d7048241ffbcb94608ae9658d7f5e611decbcd65ba 3140 
apache2-ssl-dev_2.4.59-1~deb12u1_amd64.deb
 08bf4c363375d78f6c6a2d731e5d6f6f1537aba40f1bc0eb99e820b8c71ea362 12392 
apache2-suexec-custom-dbgsym_2.4.59-1~deb12u1_amd64.deb
 631d97f2123c598f4ac9acb0951dcf518b9d513ed01b372a844a512afd0bd0ac 140492 
apache2-suexec-custom_2.4.59-1~deb12u1_amd64.deb
 fea71c46f48fad02ed5ad060589bcc2cf11fd95ef975e6b0fad11053bbdccfc0 11204 

apache2_2.4.59-1~deb11u1_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new

[Debian FTP Masters]

Thank you for your contribution to Debian.

Mapping oldstable-security to oldstable-proposed-updates.

Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 16:08:04 +0400
Source: apache2
Binary: apache2 apache2-bin apache2-bin-dbgsym apache2-data apache2-dev 
apache2-doc apache2-ssl-dev apache2-suexec-custom apache2-suexec-custom-dbgsym 
apache2-suexec-pristine apache2-suexec-pristine-dbgsym apache2-utils 
apache2-utils-dbgsym libapache2-mod-md libapache2-mod-proxy-uwsgi
Architecture: source amd64 all
Version: 2.4.59-1~deb11u1
Distribution: bullseye-security
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Description:
 apache2- Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for 
mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for 
mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 libapache2-mod-md - transitional package
 libapache2-mod-proxy-uwsgi - transitional package
Closes: 1068412
Changes:
 apache2 (2.4.59-1~deb11u1) bullseye-security; urgency=medium
 .
   * New upstream version 2.4.58
 (Closes: CVE-2023-31122, CVE-2023-43622, CVE-2023-45802)
   * Drop 2.4.56-regression patches
   * New upstream version 2.4.59
 (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Install NOTICE files
   * Update test framework
   * Refresh patches
Checksums-Sha1:
 b0c553ee2f9076ab255d36f6f77a4155e8f5180d 3539 apache2_2.4.59-1~deb11u1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 8d3d9c0ec949faa3683bc395b0955584347323a6 895172 
apache2_2.4.59-1~deb11u1.debian.tar.xz
 651b4de4722fb3cf7331e0df7147738b7015bf89 3308712 
apache2-bin-dbgsym_2.4.59-1~deb11u1_amd64.deb
 46176b8ad83ca0e991d575f498d67871b2c2e1d6 1447660 
apache2-bin_2.4.59-1~deb11u1_amd64.deb
 2cd7eef5039ed029710efc9edb1c8b8d3822381b 160212 
apache2-data_2.4.59-1~deb11u1_all.deb
 7ae879f3f9fd07d0b0faff14e40af9d955e11a3d 374820 
apache2-dev_2.4.59-1~deb11u1_amd64.deb
 a74bbd0f3c77d93b2933e9a7ca2c4daef09767ae 4085344 
apache2-doc_2.4.59-1~deb11u1_all.deb
 6b04306349ed3dab9a9baae0bb6ecc733d87101e 3148 
apache2-ssl-dev_2.4.59-1~deb11u1_amd64.deb
 592c2db4a61122edf71651806dab471f3c4fd523 12348 
apache2-suexec-custom-dbgsym_2.4.59-1~deb11u1_amd64.deb
 c8d55c5c2d152295a8f052afb4687b4c608010b6 203964 
apache2-suexec-custom_2.4.59-1~deb11u1_amd64.deb
 f15301bcdfa07e497b13d2e2b63f72b8b1b5e8d1 11140 
apache2-suexec-pristine-dbgsym_2.4.59-1~deb11u1_amd64.deb
 32bca066d4c74d879a47c9695eba65305ce40beb 202404 
apache2-suexec-pristine_2.4.59-1~deb11u1_amd64.deb
 c96298d3153025ee40865dc3114cde0cdc768cd2 115748 
apache2-utils-dbgsym_2.4.59-1~deb11u1_amd64.deb
 9d40390c27ffcfb4291074e8da52e85d7c1542a4 271100 
apache2-utils_2.4.59-1~deb11u1_amd64.deb
 b6c21fd9d72ce97e5bed90e742367bd956752d4e 12690 
apache2_2.4.59-1~deb11u1_amd64.buildinfo
 cdb3c0c6f59f347ab1a5a05759bb0da7a886a1fa 283732 
apache2_2.4.59-1~deb11u1_amd64.deb
 dba70fb6f094395bf44685af6de02efbb9112f4b 956 
libapache2-mod-md_2.4.59-1~deb11u1_amd64.deb
 93d5d7eda14453906d757151f463cae78d545069 1136 
libapache2-mod-proxy-uwsgi_2.4.59-1~deb11u1_amd64.deb
Checksums-Sha256:
 778f49efe1aab7caa9446c4027664cbc77c9b54d4f11e69fc1b1e3f4725e8b77 3539 
apache2_2.4.59-1~deb11u1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 04df061eedac33928a93afe996a9839e83a5daddc5ee53088a0bb37090ed9331 895172 
apache2_2.4.59-1~deb11u1.debian.tar.xz
 fde3f605f2591fc8ec3ef50cc3fa13e318060fe51f5fa5253654889a48989c36 3308712 
apache2-bin-dbgsym_2.4.59-1~deb11u1_amd64.deb
 a8b9c67f1f198511d1769ea1d181950c329b82110812515fcc126da12d78ac55 1447660 
apache2-bin_2.4.59-1~deb11u1_amd64.deb
 701dd3e0bae253b68d9ee12165c67557fc9b9bd485c7d6306410754dd5606ddc 160212 
apache2-data_2.4.59-1~deb11u1_all.deb
 81082a7e4bb4a469dba94655c5a28cfa215b1aeb189244066904be9eb3670f4b 374820 
apache2-dev_2.4.59-1~deb11u1_amd64.deb
 364ea71d4666f290d80692d9104e1c021380e677821b15bcdb79888be017261f 4085344 
apache2-doc_2.4.59-1~deb11u1_all.deb
 49a7fd50c283a3a039e59ab3c14702ecb2cff94296ffa9d3bded6ec6cca7c97d 3148 
apache2-ssl-dev_2.4.59-1~deb11u1_amd64.deb
 c31f146feaa81ae84ebeba6509ebf1d9cd55f9c2e8b6a5b1f5d9a5837f0ee5dc 12348 
apache2-suexec-custom-dbgsym_2.4.59-1~deb11u1_amd64.deb
 6c646b06d6187df71e36b5400a7fac1df2e578219e1856e57cd3038a7c65eefb 203964 
apache2-suexec-custom_2.4.59-1~deb11u1_amd64.deb
 

Bug#1068412: apache2: Missing Upgrade to Security Issues in bookworm

[logo]

Package: apache2
Version: 2.4.57-2
Followup-For: Bug #1068412

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Security Updates in unstable are not propagated to stable
   * What exactly did you do (or not do) that was effective (or
 ineffective)?A
Waited for the update to arrive in bookworm

   * What was the outcome of this action?
Well it's not there after almost two weeks
   * What outcome did you expect instead?
...

*** End of the template - remove these template lines ***

Apparently there are build issues in sid (maybe due to t64 migration).
However that is not a problem in bookworm and after.

Please consider to work around the issues and have a fix for "normal users". 
Ubuntu has provided the update to 2.4.59 last week already.

Thank you!
 
Bets regards

Peter

PS: below is only one of my systems. arm64, amd64 and armhf all miss this 
update!

-- System Information:
Debian Release: 12.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: arm64 (aarch64)

Kernel: Linux 6.1.0-18-arm64 (SMP w/4 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
pn  apache2-bin
pn  apache2-data   
pn  apache2-utils  
ii  init-system-helpers1.65.2
ii  lsb-base   11.6
ii  media-types10.0.0
ii  perl   5.36.0-7+deb12u1
ii  procps 2:4.0.2-3
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
pn  www-browser  

Instalacja pv

[Konrad Zieliński]

Dzień dobry,

czy są Państwo otwarci na niezobowiązującą rozmowę na temat fotowoltaiki?

Jako firma specjalizująca się w instalacji i serwisie najlepszych jakościowo 
paneli słonecznych na rynku chciałbym przedstawić propozycję, jaką wspólnie z 
zespołem przygotowaliśmy dla Państwa obiektu.

Będę wdzięczny za wiadomość od Państwa czy możemy porozmawiać.


Pozdrawiam
Konrad Zieliński

Bug#1068412: marked as done (apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)

[Debian Bug Tracking System]

Your message dated Fri, 5 Apr 2024 21:00:46 +0200
with message-id 
and subject line [ftpmas...@ftp-master.debian.org: Accepted apache2 2.4.59-1 
(source) into unstable]
has caused the Debian Bug report #1068412,
regarding apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apache2
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for apache2.

CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4

CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5

CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
https://www.cve.org/CVERecord?id=CVE-2023-38709

Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1

- Forwarded message from Debian FTP Masters 
 -

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 08:08:11 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.59-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1032628 1054564
Changes:
 apache2 (2.4.59-1) unstable; urgency=medium
 .
   [ Stefan Fritsch ]
   * Remove old transitional packages libapache2-mod-md and
 libapache2-mod-proxy-uwsgi. Closes: #1032628
 .
   [ Yadd ]
   * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
   * Refresh patches
   * New upstream version 2.4.59
   * Refresh patches
   * Update patches
   * Update test framework
Checksums-Sha1: 
 f1cf18103ca23c57beaa2985bbbe4eee1e8dff87 3334 apache2_2.4.59-1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 3e1cad5ee1fc66d350465c1e81d7e0f88221bc01 820300 apache2_2.4.59-1.debian.tar.xz
Checksums-Sha256: 
 25e6990e65cb685f3172143648806ab0fd263a18cd412155f0d14d7ef9987428 3334 
apache2_2.4.59-1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 1e869a5024215a2a9b69603daf1395840774640f7b2701ca4b7971452a0641d1 820300 
apache2_2.4.59-1.debian.tar.xz
Files: 
 3f3ee286b583f22ec5cb3efc1f0a5016 3334 httpd optional apache2_2.4.59-1.dsc
 c39d28e0777bc95631cb49958fdb6601 9843252 httpd optional 
apache2_2.4.59.orig.tar.gz
 3c342b3dcc0fe227a1fffdf9997987d0 833 httpd optional 
apache2_2.4.59.orig.tar.gz.asc
 4da024370ede9c5a75a0df725be0cdc5 820300 httpd optional 
apache2_2.4.59-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYPec8ACgkQ9tdMp8mZ
7umCiw//TB1rIA1czwHsUrdeOIT3HG9qERzBJsmsP8nyg+cIrytiGfhlt2eOmLYO
X+Wo19J98VuCmTbJClb6opAfSpvJG2AmNUl/PYAqOBzvDgR+QlEMmVXVgxUp9+Tv
0e0P2H+8U0pO3dE51VIXqYtCLTLQnLaci763ewB0oRlSWuzoVNDDahUS3iJ5e58o
btwUQQwq+2F+RBclRhuXca3dOI93UBZDsv56mxR+p2o0vpo+pQRZjHDv8tzT3bOq
/PyWusXKPDf9MXYZqwY2TgYx8v/YdDVYqzgr6Tj/VXgXEKC22pudzSv9/J5iGfHh
VHmf02Gh+0wNWmxajqK2KlxjMON/Qn6kyoAok9w5vv4HtOXBZimzdq0kDsc8EjJl
QuaBcwIAy+0EATBhjaVY7sHtM9SydJNr1f4DBBD9kEB2DKEE9n7/iFxcFfSMd52Y
xwJ4fPk1fe1ki7k/qn0VULpzf1iM3JDQE19uXyE29cSW4eJhiWvH1v+NZzzxNo+t
NtDhSIEEnUkGZSsYyg2qg5NH3e3PJMadc1nTRY6hVNzGpJlsUrCKnMOZbJsBQM6S
cNCY48ux8ziQmJNowvBVbXf6/+SH9h2+CYFRw9GZagaNe1yfErNglbn78KZqJUHw
YcXIFc96qeznRJ9zRhPdHGGeqa+nETH1lWBp6eitihkKhDjCF48=
=dQDE
-END PGP SIGNATURE-




- End forwarded message  End Message ---

Processed: found 1068412 in 2.4.57-2, found 1068412 in 2.4.56-1~deb11u2

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> found 1068412 2.4.57-2
Bug #1068412 [src:apache2] apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
Marked as found in versions apache2/2.4.57-2.
> found 1068412 2.4.56-1~deb11u2
Bug #1068412 [src:apache2] apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
Marked as found in versions apache2/2.4.56-1~deb11u2.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

[ftpmas...@ftp-master.debian.org: Accepted apache2 2.4.59-1 (source) into unstable]

[Salvatore Bonaccorso]

Source: apache2
Source-Version: 2.4.59-1

- Forwarded message from Debian FTP Masters 
 -

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 08:08:11 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.59-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1032628 1054564
Changes:
 apache2 (2.4.59-1) unstable; urgency=medium
 .
   [ Stefan Fritsch ]
   * Remove old transitional packages libapache2-mod-md and
 libapache2-mod-proxy-uwsgi. Closes: #1032628
 .
   [ Yadd ]
   * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
   * Refresh patches
   * New upstream version 2.4.59
   * Refresh patches
   * Update patches
   * Update test framework
Checksums-Sha1: 
 f1cf18103ca23c57beaa2985bbbe4eee1e8dff87 3334 apache2_2.4.59-1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 3e1cad5ee1fc66d350465c1e81d7e0f88221bc01 820300 apache2_2.4.59-1.debian.tar.xz
Checksums-Sha256: 
 25e6990e65cb685f3172143648806ab0fd263a18cd412155f0d14d7ef9987428 3334 
apache2_2.4.59-1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 1e869a5024215a2a9b69603daf1395840774640f7b2701ca4b7971452a0641d1 820300 
apache2_2.4.59-1.debian.tar.xz
Files: 
 3f3ee286b583f22ec5cb3efc1f0a5016 3334 httpd optional apache2_2.4.59-1.dsc
 c39d28e0777bc95631cb49958fdb6601 9843252 httpd optional 
apache2_2.4.59.orig.tar.gz
 3c342b3dcc0fe227a1fffdf9997987d0 833 httpd optional 
apache2_2.4.59.orig.tar.gz.asc
 4da024370ede9c5a75a0df725be0cdc5 820300 httpd optional 
apache2_2.4.59-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYPec8ACgkQ9tdMp8mZ
7umCiw//TB1rIA1czwHsUrdeOIT3HG9qERzBJsmsP8nyg+cIrytiGfhlt2eOmLYO
X+Wo19J98VuCmTbJClb6opAfSpvJG2AmNUl/PYAqOBzvDgR+QlEMmVXVgxUp9+Tv
0e0P2H+8U0pO3dE51VIXqYtCLTLQnLaci763ewB0oRlSWuzoVNDDahUS3iJ5e58o
btwUQQwq+2F+RBclRhuXca3dOI93UBZDsv56mxR+p2o0vpo+pQRZjHDv8tzT3bOq
/PyWusXKPDf9MXYZqwY2TgYx8v/YdDVYqzgr6Tj/VXgXEKC22pudzSv9/J5iGfHh
VHmf02Gh+0wNWmxajqK2KlxjMON/Qn6kyoAok9w5vv4HtOXBZimzdq0kDsc8EjJl
QuaBcwIAy+0EATBhjaVY7sHtM9SydJNr1f4DBBD9kEB2DKEE9n7/iFxcFfSMd52Y
xwJ4fPk1fe1ki7k/qn0VULpzf1iM3JDQE19uXyE29cSW4eJhiWvH1v+NZzzxNo+t
NtDhSIEEnUkGZSsYyg2qg5NH3e3PJMadc1nTRY6hVNzGpJlsUrCKnMOZbJsBQM6S
cNCY48ux8ziQmJNowvBVbXf6/+SH9h2+CYFRw9GZagaNe1yfErNglbn78KZqJUHw
YcXIFc96qeznRJ9zRhPdHGGeqa+nETH1lWBp6eitihkKhDjCF48=
=dQDE
-END PGP SIGNATURE-




- End forwarded message -

Bug#1068412: apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709

[Yadd]

On 4/5/24 15:58, Moritz Muehlenhoff wrote:

On Fri, Apr 05, 2024 at 08:16:43AM +0400, Yadd wrote:

On 4/4/24 22:51, Moritz Mühlenhoff wrote:

Source: apache2
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for apache2.

CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4

CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5

CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
  https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
  https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
  https://www.cve.org/CVERecord?id=CVE-2023-38709

Please adjust the affected versions in the BTS as needed.


Hi,

I'm ready to push 2.4.59 into bookworm-security. Note that this includes a
test-framework update


Target distribution needs to be bookworm-security, with that please upload.
Can you also preparea the equivalent change for bullseye-security?

The uploads can already happen, but let's keep the update unreleased until
next week, then we can look for regressions reported in unstable (and check
with Ondrej if we received reports based on his repo)

Cheers,
 Moritz


Both Bullseye and Bookworm uploaded. Bullseye version embeds also a 
copyright fix

Bug#1068412: apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709

[Moritz Muehlenhoff]

On Fri, Apr 05, 2024 at 08:16:43AM +0400, Yadd wrote:
> On 4/4/24 22:51, Moritz Mühlenhoff wrote:
> > Source: apache2
> > X-Debbugs-CC: t...@security.debian.org
> > Severity: grave
> > Tags: security
> > 
> > Hi,
> > 
> > The following vulnerabilities were published for apache2.
> > 
> > CVE-2024-27316[0]:
> > https://www.kb.cert.org/vuls/id/421644
> > https://www.openwall.com/lists/oss-security/2024/04/04/4
> > 
> > CVE-2024-24795[1]:
> > https://www.openwall.com/lists/oss-security/2024/04/04/5
> > 
> > CVE-2023-38709[2]:
> > https://www.openwall.com/lists/oss-security/2024/04/04/3
> > 
> > If you fix the vulnerabilities please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> > 
> > For further information see:
> > 
> > [0] https://security-tracker.debian.org/tracker/CVE-2024-27316
> >  https://www.cve.org/CVERecord?id=CVE-2024-27316
> > [1] https://security-tracker.debian.org/tracker/CVE-2024-24795
> >  https://www.cve.org/CVERecord?id=CVE-2024-24795
> > [2] https://security-tracker.debian.org/tracker/CVE-2023-38709
> >  https://www.cve.org/CVERecord?id=CVE-2023-38709
> > 
> > Please adjust the affected versions in the BTS as needed.
> 
> Hi,
> 
> I'm ready to push 2.4.59 into bookworm-security. Note that this includes a
> test-framework update

Target distribution needs to be bookworm-security, with that please upload.
Can you also preparea the equivalent change for bullseye-security?

The uploads can already happen, but let's keep the update unreleased until
next week, then we can look for regressions reported in unstable (and check
with Ondrej if we received reports based on his repo)

Cheers,
Moritz

Bug#1054564: marked as done (apache2: mod_proxy_connect insecure default server-wide AllowCONNECT value)

[Debian Bug Tracking System]

Your message dated Fri, 05 Apr 2024 04:34:28 +
with message-id 
and subject line Bug#1054564: fixed in apache2 2.4.59-1
has caused the Debian Bug report #1054564,
regarding apache2: mod_proxy_connect insecure default server-wide AllowCONNECT 
value
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1054564: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054564
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apache2
Version: 2.4.56-1~deb11u2
Severity: normal
X-Debbugs-Cc: raphael.d...@gmail.com

Dear Maintainer,

# Context

For years, one of my SSL vhost (on :443) has been relying mod_proxy_http to 
(safely)
 forward some requests to a backend, acting as a reverse-proxy.
```
# Something like
ProxyRequests   On
SSLProxyEngine  On
RewriteRule ^/.well-known/.*$ "https://gitlab-foobar/%{REQUEST_URI}; [P,L]
```


Recently, I experienced the need to (safely) forward some requests (from 
another server I own)
 through this server (because of some network/geoblocking problem).
I enabled `mod_proxy_connect` and (safely) configured a forward-proxy on :80 
(using `Require valid-user / ip`).
```
# Something like
ProxyRequests On
Authtype Basic
AuthUserFile ...

p  Require valid-user
  Require ip ...

```


# Problem

While this :80 forward-proxy vhost was secure, I later discovered, that 
 the original (and almost forgotten) vhost had incidentally become an 
open-proxy (!)

The reasons are:
- mod_proxy_connect is globally enabled (affects all vhosts)
- AllowCONNECT defaults to "443 563" (affects all vhosts)


Said otherwise, *any* secure reverse-proxy vhost configuration become de-facto
 an insecure open forward-proxy vhost as soon as `mod_proxy_connect` is 
globally enabled.

This sounds contrary to best security practices.
(and I bet more than one server out there is silently affected by this 
insecure-by-default
configuration)


# Proposed solution

I suggest to add a server-wide `AllowCONNECT 0` directive inside
`/etc/apache2/mods-available/proxy_connect.load` (virtually disabling CONNECT)
so that individual vhosts relying on it would have to explicitely set the value 
at the vhost-level.

It would be more logical (scope/side-effects) and avoid holes being punched 
into existing
 (and otherwise secure) reverse-proxy vhosts.


# Additional notes
To cap it all my proxy-enabled vhost was the first one (lexicographically
speaking) making it the destination of all the random internet SSL traffic 
scanners.


Google-friendly list of typical log messages that should raise flags:
> AH00898: Connect to remote machine blocked returned by...
> AH00939: CONNECT: attempt to connect to ...:443 (...) failed
> AH10221: proxy: CONNECT: client flushing failed (-102)
> AH10221: proxy: CONNECT: origin flushing failed (-102)


-- Package-specific info:

-- System Information:
Debian Release: bullseye
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.2.0-35-generic (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2 depends on:
ii  apache2-bin  2.4.56-1~deb11u2
ii  apache2-data 2.4.56-1~deb11u2
ii  apache2-utils2.4.56-1~deb11u2

Versions of packages apache2 recommends:
pn  ssl-cert  

Versions of packages apache2 suggests:
pn  apache2-doc   
pn  apache2-suexec-pristine | apache2-suexec  

Versions of packages apache2 is related to:
ii  apache2  2.4.56-1~deb11u2
ii  apache2-bin  2.4.56-1~deb11u2

-- Configuration Files:
/etc/apache2/apache2.conf changed [not included]

-- no debconf information

-- 
GPG id: 0xF41572CEBD4218F4
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1054...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing 

Bug#1032628: marked as done (please drop transitional package libapache2-mod-proxy-uwsgi from src:apache2)

[Debian Bug Tracking System]

Your message dated Fri, 05 Apr 2024 04:34:28 +
with message-id 
and subject line Bug#1032628: fixed in apache2 2.4.59-1
has caused the Debian Bug report #1032628,
regarding please drop transitional package libapache2-mod-proxy-uwsgi from 
src:apache2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1032628: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032628
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: libapache2-mod-proxy-uwsgi
Version: 2.4.56-1
Severity: normal
user: qa.debian@packages.debian.org
usertags: transitional

Please drop the transitional package libapache2-mod-proxy-uwsgi (from the 
source package apache2) after the release of bookworm, it has been released 
with buster and bullseye already...


Description: transitional package
Package: libapache2-mod-proxy-uwsgi
Version: 2.4.38-3+deb10u8
Version: 2.4.54-1~deb11u1
Version: 2.4.56-1

Thanks for maintaining apache2!


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Try to imagine a future where paying for your morning coffee involved smashing
an iPhone and burning enough fossil fuels to run your entire household for 60
days. That's the environmental cost of the "revolutionary" technology behind
Bitcoin in a nutshell. https://twitter.com/smdiehl/status/1350869944888664064


signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: apache2
Source-Version: 2.4.59-1
Done: Yadd 

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1032...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yadd  (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 08:08:11 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.59-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1032628 1054564
Changes:
 apache2 (2.4.59-1) unstable; urgency=medium
 .
   [ Stefan Fritsch ]
   * Remove old transitional packages libapache2-mod-md and
 libapache2-mod-proxy-uwsgi. Closes: #1032628
 .
   [ Yadd ]
   * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
   * Refresh patches
   * New upstream version 2.4.59
   * Refresh patches
   * Update patches
   * Update test framework
Checksums-Sha1: 
 f1cf18103ca23c57beaa2985bbbe4eee1e8dff87 3334 apache2_2.4.59-1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 3e1cad5ee1fc66d350465c1e81d7e0f88221bc01 820300 apache2_2.4.59-1.debian.tar.xz
Checksums-Sha256: 
 25e6990e65cb685f3172143648806ab0fd263a18cd412155f0d14d7ef9987428 3334 
apache2_2.4.59-1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 1e869a5024215a2a9b69603daf1395840774640f7b2701ca4b7971452a0641d1 820300 
apache2_2.4.59-1.debian.tar.xz
Files: 
 3f3ee286b583f22ec5cb3efc1f0a5016 3334 httpd optional apache2_2.4.59-1.dsc
 c39d28e0777bc95631cb49958fdb6601 9843252 httpd optional 
apache2_2.4.59.orig.tar.gz
 3c342b3dcc0fe227a1fffdf9997987d0 833 httpd optional 
apache2_2.4.59.orig.tar.gz.asc
 4da024370ede9c5a75a0df725be0cdc5 820300 httpd optional 
apache2_2.4.59-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYPec8ACgkQ9tdMp8mZ
7umCiw//TB1rIA1czwHsUrdeOIT3HG9qERzBJsmsP8nyg+cIrytiGfhlt2eOmLYO
X+Wo19J98VuCmTbJClb6opAfSpvJG2AmNUl/PYAqOBzvDgR+QlEMmVXVgxUp9+Tv
0e0P2H+8U0pO3dE51VIXqYtCLTLQnLaci763ewB0oRlSWuzoVNDDahUS3iJ5e58o
btwUQQwq+2F+RBclRhuXca3dOI93UBZDsv56mxR+p2o0vpo+pQRZjHDv8tzT3bOq
/PyWusXKPDf9MXYZqwY2TgYx8v/YdDVYqzgr6Tj/VXgXEKC22pudzSv9/J5iGfHh
VHmf02Gh+0wNWmxajqK2KlxjMON/Qn6kyoAok9w5vv4HtOXBZimzdq0kDsc8EjJl

Processing of apache2_2.4.59-1_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.59-1_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.59-1.dsc
  apache2_2.4.59.orig.tar.gz
  apache2_2.4.59.orig.tar.gz.asc
  apache2_2.4.59-1.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

apache2_2.4.59-1_sourceonly.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2024 08:08:11 +0400
Source: apache2
Built-For-Profiles: nocheck
Architecture: source
Version: 2.4.59-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Yadd 
Closes: 1032628 1054564
Changes:
 apache2 (2.4.59-1) unstable; urgency=medium
 .
   [ Stefan Fritsch ]
   * Remove old transitional packages libapache2-mod-md and
 libapache2-mod-proxy-uwsgi. Closes: #1032628
 .
   [ Yadd ]
   * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
   * Refresh patches
   * New upstream version 2.4.59
   * Refresh patches
   * Update patches
   * Update test framework
Checksums-Sha1: 
 f1cf18103ca23c57beaa2985bbbe4eee1e8dff87 3334 apache2_2.4.59-1.dsc
 7a118baaed0f2131e482f93f5057038ca6c021be 9843252 apache2_2.4.59.orig.tar.gz
 837cdf46898d962c4c05642745566249fc91e52b 833 apache2_2.4.59.orig.tar.gz.asc
 3e1cad5ee1fc66d350465c1e81d7e0f88221bc01 820300 apache2_2.4.59-1.debian.tar.xz
Checksums-Sha256: 
 25e6990e65cb685f3172143648806ab0fd263a18cd412155f0d14d7ef9987428 3334 
apache2_2.4.59-1.dsc
 e4ec4ce12c6c8f5a794dc2263d126cb1d6ef667f034c4678ec945d61286e8b0f 9843252 
apache2_2.4.59.orig.tar.gz
 0ad3f670b944ebf08c81544bc82fae9496e88d96840cd0612d8cdeaa073eb06d 833 
apache2_2.4.59.orig.tar.gz.asc
 1e869a5024215a2a9b69603daf1395840774640f7b2701ca4b7971452a0641d1 820300 
apache2_2.4.59-1.debian.tar.xz
Files: 
 3f3ee286b583f22ec5cb3efc1f0a5016 3334 httpd optional apache2_2.4.59-1.dsc
 c39d28e0777bc95631cb49958fdb6601 9843252 httpd optional 
apache2_2.4.59.orig.tar.gz
 3c342b3dcc0fe227a1fffdf9997987d0 833 httpd optional 
apache2_2.4.59.orig.tar.gz.asc
 4da024370ede9c5a75a0df725be0cdc5 820300 httpd optional 
apache2_2.4.59-1.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmYPec8ACgkQ9tdMp8mZ
7umCiw//TB1rIA1czwHsUrdeOIT3HG9qERzBJsmsP8nyg+cIrytiGfhlt2eOmLYO
X+Wo19J98VuCmTbJClb6opAfSpvJG2AmNUl/PYAqOBzvDgR+QlEMmVXVgxUp9+Tv
0e0P2H+8U0pO3dE51VIXqYtCLTLQnLaci763ewB0oRlSWuzoVNDDahUS3iJ5e58o
btwUQQwq+2F+RBclRhuXca3dOI93UBZDsv56mxR+p2o0vpo+pQRZjHDv8tzT3bOq
/PyWusXKPDf9MXYZqwY2TgYx8v/YdDVYqzgr6Tj/VXgXEKC22pudzSv9/J5iGfHh
VHmf02Gh+0wNWmxajqK2KlxjMON/Qn6kyoAok9w5vv4HtOXBZimzdq0kDsc8EjJl
QuaBcwIAy+0EATBhjaVY7sHtM9SydJNr1f4DBBD9kEB2DKEE9n7/iFxcFfSMd52Y
xwJ4fPk1fe1ki7k/qn0VULpzf1iM3JDQE19uXyE29cSW4eJhiWvH1v+NZzzxNo+t
NtDhSIEEnUkGZSsYyg2qg5NH3e3PJMadc1nTRY6hVNzGpJlsUrCKnMOZbJsBQM6S
cNCY48ux8ziQmJNowvBVbXf6/+SH9h2+CYFRw9GZagaNe1yfErNglbn78KZqJUHw
YcXIFc96qeznRJ9zRhPdHGGeqa+nETH1lWBp6eitihkKhDjCF48=
=dQDE
-END PGP SIGNATURE-



pgpiykvbhrNFr.pgp
Description: PGP signature

Processed: tagging 1068412

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> tags 1068412 + upstream
Bug #1068412 [src:apache2] apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
Added tag(s) upstream.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: found 1068412 in 2.4.58-1

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> found 1068412 2.4.58-1
Bug #1068412 [src:apache2] apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
Marked as found in versions apache2/2.4.58-1.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1068412: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1068412: apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709

[Moritz Mühlenhoff]

Source: apache2
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for apache2.

CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4

CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5

CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
https://www.cve.org/CVERecord?id=CVE-2023-38709

Please adjust the affected versions in the BTS as needed.

Bug#1057126: Bug#1067104: Acknowledgement (server stalls: AH00046: child process 2876749 still did not exit, sending a SIGKILL)

[Peter Krefting]

2024-03-21 13:12 skrev Yaroslav Halchenko:


FWIW here is a dirty workaround script I just crafted with chatgpt to
monitor/restart apache2 as soon as it starts happening


My workaround is simpler, I have this line in root's crontab:

 5 * * * * curl --silent --max-time 5 --output /dev/null 
http://localhost/trac/ || systemctl restart apache2


It seems to restart Apache once every 5-8 days, according to the notices 
I see from Zabbix. The frequency might very well be related to the 
number of accesses to the server.


--
\\// Peter - http://www.softwolves.pp.se/

Bug#1057126: Bug#1067104: Acknowledgement (server stalls: AH00046: child process 2876749 still did not exit, sending a SIGKILL)

[Yaroslav Halchenko]

"All ingenious is simple" -- thanks for sharing.  I might redo following
your example but to check more frequently.

On Thu, 21 Mar 2024, Peter Krefting wrote:
> My workaround is simpler, I have this line in root's crontab:

>  5 * * * * curl --silent --max-time 5 --output /dev/null
> http://localhost/trac/ || systemctl restart apache2

-- 
Yaroslav O. Halchenko
Center for Open Neuroscience http://centerforopenneuroscience.org
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
WWW:   http://www.linkedin.com/in/yarik

Bug#1057126: Bug#1067104: Acknowledgement (server stalls: AH00046: child process 2876749 still did not exit, sending a SIGKILL)

[Yaroslav Halchenko]

I think "my" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067104
is a duplicate of this one.  I blame mod_wsgi since this I believe
started to happen after I started to use it.

FWIW here is a dirty workaround script I just crafted with chatgpt to
monitor/restart apache2 as soon as it starts happening (doesn't happen upon
every maintenance event for me I believe). Let me know if I should gather any
additional information.

#!/bin/bash

set -eu

# Define the lock file and log directory
lock_file="/var/log/apache-scoreboard-restart/lock.lck"
log_dir="/var/log/apache-scoreboard-restart/"

# Ensure the log directory exists
mkdir -p "$log_dir"

# Attempt to acquire a lock
exec 200>"$lock_file"
if ! flock -n 200 ; then
echo "Another instance is running."
exit 0
fi

# Function to perform actions when the specified log line is found
handle_scoreboard_full() {
local timestamp=$(date --iso-8601=seconds)
local log_file="${log_dir}${timestamp}.log"

echo "Logging system information to $log_file."
{ ps auxw -H; echo "---"; lsof; } > "$log_file"

echo "Reloading Apache." >> "$log_file"
service apache2 reload

echo "Sleeping for a minute." >> "$log_file"
sleep 60
}

# Monitor the Apache error log
while true; do
tail --follow=name /var/log/apache2/error.log | while read line 
; do
if echo "$line" | grep -q "AH03490: scoreboard is full, 
not at MaxRequestWorkers.Increase ServerLimit." ; then
handle_scoreboard_full
break  # so we start with a fresh tail
fi
done
done

-- 
Yaroslav O. Halchenko
Center for Open Neuroscience http://centerforopenneuroscience.org
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
WWW:   http://www.linkedin.com/in/yarik



signature.asc
Description: PGP signature

Bug#1067104: server stalls: AH00046: child process 2876749 still did not exit, sending a SIGKILL

[Stefan Fritsch]

Am 18.03.24 um 13:59 schrieb Yaroslav Halchenko:

Package: apache2
Version: 2.4.57-2
Severity: important

Server was working just fine for years and recently started to stall
completely after 3-7 days of functioning normally.  error logs get filled up
first with AH03490 and then eventually with AH00045 messages:

 [Sun Mar 17 02:26:01.353381 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
 ...
 [Sun Mar 17 22:00:42.201774 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
 [Sun Mar 17 22:00:42.995574 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
 [Sun Mar 17 22:00:42.998488 2024] [mpm_event:notice] [pid 2649373:tid 
139846579189632] AH00492: caught SIGWINCH, shutting down gracefully
 [Sun Mar 17 22:00:46.358981 2024] [core:warn] [pid 2649373:tid 
139846579189632] AH00045: child process 2649375 still did not exit, sending a 
SIGTERM
 [Sun Mar 17 22:00:46.359064 2024] [core:warn] [pid 2649373:tid 
139846579189632] AH00045: child process 2649376 still did not exit, sending a 
SIGTERM


Have you tried increasing ServerLimit as the warning suggests?

Apart from that, it is probably the same as 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057126 . mod_wsgi or 
some python script is preventing apache processes from dying and they 
accumulate until the scroeboard is full. Which versions of the wsgi 
related packages are you using?

Processed: tagging 1032628

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> tags 1032628 + pending
Bug #1032628 [libapache2-mod-proxy-uwsgi] please drop transitional package 
libapache2-mod-proxy-uwsgi from src:apache2
Added tag(s) pending.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1032628: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032628
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1031034: marked as done (apr: Missing LFS support triggers FTBFS on other packages)

[Debian Bug Tracking System]

Your message dated Tue, 19 Mar 2024 11:28:35 +0100
with message-id 
and subject line Re: Bug#1031034: apr: Missing LFS support triggers FTBFS on 
other packages
has caused the Debian Bug report #1031034,
regarding apr: Missing LFS support triggers FTBFS on other packages
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1031034: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031034
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---

Package: apr
Tags: ftbfs, hppa, lfs
Version: 1.7.2-2

On 32-bit platforms it's necessary to compile programs and libraries
with Large File Support (LFS) in order to allow them to function correctly on
filesystems with > 2GB or 4GB size.
This can be solved by adding "-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" to
the CFLAGS variable when compiling.

apr is currently missing this LFS support and as such it triggers
build-from-source errors in other packages like "subversion" or "devscripts"
on such 32-bit platforms.

There are various possibilities how to add those two defines,
e.g. adding
DEB_BUILD_MAINT_OPTIONS = future=+lfs

or by manually adding the output of
getconf LFS_CFLAGS
to the CFLAGS variable. Please note, on 64-bit platforms the return value
will be empty which is correct as those flags are not needed on 64-bit arches.

Here is one suggested patch for apr from me:

diff -up ./debian/rules.org ./debian/rules
--- ./debian/rules.org  2023-02-10 16:20:07.911340588 +
+++ ./debian/rules  2023-02-10 15:54:17.992511554 +
@@ -11,6 +11,9 @@ DEB_HOST_ARCH_OS?= $(shell dpkg-arch
 DEB_HOST_ARCH_BITS  ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_BITS)
 DEB_HOST_MULTIARCH  ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)

+# Enable Large File Support (LFS) if necessary:  -D_LARGEFILE_SOURCE 
-D_FILE_OFFSET_BITS=64
+CFLAGS := $(shell dpkg-buildflags --get CFLAGS) $(shell getconf LFS_CFLAGS)
+
 # The 'build' target needs special handling because there there is a directory
 # named 'build'.
 .PHONY: build

Please apply this (or another patch) to allow apr to build with LFS support.

Thanks,
Helge
--- End Message ---
--- Begin Message ---

version: 1.7.2-3.2

Am 20.06.23 um 20:27 schrieb Stefan Fritsch:
It seems a large transition will be needed for 64bit time_t, anyway. And 
glibc enforces _FILE_OFFSET_BITS=64 if _TIME_BITS=64 is set. apr should 
do both transitions at the same time.


It seems there won't be a transition for i386 but the whole point of 
i386 is running old binaries.


https://wiki.debian.org/ReleaseGoals/64bit-time



This is fixed now as apr has been rebuilt with 64bit time_t, which 
implies 64 bit ino_t.--- End Message ---

Bug#1067120: nmu: apache2_2.4.58-1

[Stefan Fritsch]

Package: release.debian.org
Severity: normal
X-Debbugs-Cc: apac...@packages.debian.org
Control: affects -1 + src:apache2
User: release.debian@packages.debian.org
Usertags: binnmu

libaprutil1t64 1.6.3-1.1 contains a wrong symbol file, causing a wrong
dependency on libaprutil164 (missing a "t") for packages using the
apr_dbd_init or apr_ldap_init symbols. AFAICS, only apache2 is affected.  

Note that there is already apache2 2.4.58-1+b2 . I am not sure which
version is the correct one in the nmu syntax.

nmu apache2_2.4.58-1 . ANY . unstable . -m "Rebuild with fixed libaprutil1t64 
for #1067035"
dw apache2_2.4.58-1 . ANY . -m "libaprutil1-dev (>= 1.6.3-2)"

Bug#1067035: marked as done (apache2-bin: rebuild for the 64-bit time_t migration is uninstallable)

[Debian Bug Tracking System]

Your message dated Mon, 18 Mar 2024 21:01:39 +0100
with message-id 
and subject line Re: Bug#1067035: apache2-bin: rebuild for the 64-bit time_t 
migration is uninstallable
has caused the Debian Bug report #1067035,
regarding apache2-bin: rebuild for the 64-bit time_t migration is uninstallable
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1067035: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067035
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apache2-bin
Version: 2.4.58-1+b2
Severity: serious
Justification: uninstallable

Dear Maintainer,

Attempting to upgrade apache2-bin from rebuild 2.4.58-1+b1 to
the rebuild 2.4.58-1+b2 leads to the following error:

$ sudo apt upgrade apache2-bin
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 apache2-bin : Depends: libaprutil164 (>= 1.2.7+dfsg) but it is not 
installable
E: Broken packages

libaprutil164 (note the missing 't' for "t64") is not available
in unstable.  The dependency looks typoed and duplicated, as
libaprutil1t64 (>= 1.6.0) is also present as needed in the
Depends field,

Otherwise, have a nice Sunday,  :)
Étienne.


-- Package-specific info:

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.7.9-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2-bin depends on:
ii  libapr1t64 [libapr1]  1.7.2-3.2
ii  libaprutil1-dbd-sqlite3   1.6.3-1.1+b1
ii  libaprutil1-ldap  1.6.3-1.1+b1
ii  libaprutil1t64 [libaprutil1]  1.6.3-1.1+b1
ii  libbrotli11.1.0-2+b3
ii  libc6 2.37-15.1
ii  libcrypt1 1:4.4.36-4
ii  libcurl4t64 [libcurl4]8.6.0-4
ii  libjansson4   2.14-2+b2
ii  libldap-2.5-0 2.5.16+dfsg-2
ii  liblua5.3-0   5.3.6-2+b2
ii  libnghttp2-14 1.59.0-1+b1
ii  libpcre2-8-0  10.42-4+b1
ii  libssl3t64 [libssl3]  3.1.5-1.1
ii  libxml2   2.9.14+dfsg-1.3+b2
ii  perl  5.38.2-3.2
ii  zlib1g1:1.3.dfsg-3.1

apache2-bin recommends no packages.

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  firefox-esr [www-browser]115.8.0esr-1+b1
ii  lynx [www-browser]   2.9.0rel.0-2+b1
ii  surf [www-browser]   2.1+git20221016-6+b1
ii  w3m [www-browser]0.5.3+git20230121-2+b3

Versions of packages apache2 depends on:
ii  apache2-data 2.4.58-1
ii  apache2-utils2.4.58-1+b1
ii  init-system-helpers  1.66
ii  media-types  10.1.0
ii  perl 5.38.2-3.2
ii  procps   2:4.0.4-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  firefox-esr [www-browser]115.8.0esr-1+b1
ii  lynx [www-browser]   2.9.0rel.0-2+b1
ii  surf [www-browser]   2.1+git20221016-6+b1
ii  w3m [www-browser]0.5.3+git20230121-2+b3

Versions of packages apache2-bin is related to:
ii  apache2  2.4.58-1+b1
ii  apache2-bin  2.4.58-1+b1

-- no debconf information

-- 
  .''`.  Étienne Mollier 
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/4, please excuse my verbosity
   `-on air: Antony Kalugin - Key


signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---

version: 1.6.3-2

Am 17.03.24 um 15:19 schrieb 

Processing of apr-util_1.6.3-2_source.changes

[Debian FTP Masters]

apr-util_1.6.3-2_source.changes uploaded successfully to localhost
along with the files:
  apr-util_1.6.3-2.dsc
  apr-util_1.6.3-2.debian.tar.xz
  apr-util_1.6.3-2_source.buildinfo

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

Processed: tagging 1067035, tagging 1066821

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> tags 1067035 + pending
Bug #1067035 [libaprutil1t64] apache2-bin: rebuild for the 64-bit time_t 
migration is uninstallable
Added tag(s) pending.
> tags 1066821 + pending
Bug #1066821 {Done: Stefan Fritsch } [src:apr-util] apr-util: 
FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 Segmentation fault  
LD_LIBRARY_PATH="`echo 
"../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | 
sed -e 's/::*$//'`" ./$prog -v
Added tag(s) pending.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1066821: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1066821
1067035: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067035
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1066821: marked as done (apr-util: FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 Segmentation fault LD_LIBRARY_PATH="`echo "../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRA

[Debian Bug Tracking System]

Your message dated Mon, 18 Mar 2024 19:49:13 +
with message-id 
and subject line Bug#1066821: fixed in apr-util 1.6.3-2
has caused the Debian Bug report #1066821,
regarding apr-util: FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 
Segmentation fault  LD_LIBRARY_PATH="`echo 
"../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | 
sed -e 's/::*$//'`" ./$prog -v
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1066821: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1066821
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apr-util
Version: 1.6.3-1.1
Severity: serious
Tags: ftbfs
Justification: fails to build from source (but built successfully in the past)
X-Debbugs-Cc: sramac...@debian.org

https://buildd.debian.org/status/fetch.php?pkg=apr-util=armhf=1.6.3-1.1=1709086833=0

testldap:  SUCCESS
testdbd :  SUCCESS
testdate:  SUCCESS
testmemcache:  Error 111 occurred attempting to reach memcached on 
localhost:11211.  Skipping apr_memcache tests...
SUCCESS
testredis   :  Error 111 occurred attempting to reach Redis on 
localhost:6379.  Skipping apr_redis tests...
SUCCESS
testxml :  SUCCESS
testxlate   :  SUCCESS
testrmm :  SUCCESS
testdbm :  BDB1565 DB->put: method not permitted before handle's 
open method
/bin/bash: line 3: 3132384 Segmentation fault  LD_LIBRARY_PATH="`echo 
"../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | 
sed -e 's/::*$//'`" ./$prog -v
Programs failed: testall
make[2]: *** [Makefile:60: check] Error 139

Cheers
-- 
Sebastian Ramacher
--- End Message ---
--- Begin Message ---
Source: apr-util
Source-Version: 1.6.3-2
Done: Stefan Fritsch 

We believe that the bug you reported is fixed in the latest version of
apr-util, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1066...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch  (supplier of updated apr-util package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 18 Mar 2024 20:21:56 +0100
Source: apr-util
Architecture: source
Version: 1.6.3-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Stefan Fritsch 
Closes: 1066821
Changes:
 apr-util (1.6.3-2) unstable; urgency=medium
 .
   * Incorporate NMU. Thanks to all the 64-bit time_t transition
 people.
   * Bump libapr1-dev Build-Dep to 1.7.2-3.2. Hopefully
 closes: #1066821
   * Add more 64-bit time_t patches from Simon McVittie. Thanks.
 Closes: #1066821
Checksums-Sha1:
 e54da49c48a25eaa47c11c1649122dde4996948d 2790 apr-util_1.6.3-2.dsc
 0a3ba0d15d92ea2a6b4743fa84bcdfcbb9dfb0ac 341028 apr-util_1.6.3-2.debian.tar.xz
 8e751c5f1abc1d5eeb09c253c51e5eca51d74d0d 8920 apr-util_1.6.3-2_source.buildinfo
Checksums-Sha256:
 ec0980c33c48706d28ee3894c543f2f2fe4a6e0f4b7b233f6448205934b2079f 2790 
apr-util_1.6.3-2.dsc
 5dd4abc7e74af270900b953523ee50ebc44bb794fba64a08111f3c1ac9942fb4 341028 
apr-util_1.6.3-2.debian.tar.xz
 0060c54212516ee4f898e3dceff0c339586f6a10f645866b91e28f732a9f1914 8920 
apr-util_1.6.3-2_source.buildinfo
Files:
 2bd4a9312509ac42206b46bbbc4d60ff 2790 libs optional apr-util_1.6.3-2.dsc
 132c383916b36665b64db1820a859540 341028 libs optional 
apr-util_1.6.3-2.debian.tar.xz
 ef4a4a49dd973d32bcce3d1e9f688cbd 8920 libs optional 
apr-util_1.6.3-2_source.buildinfo

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEOpiNza8JqByyYYsxxodfNUHO/eAFAmX4lSIACgkQxodfNUHO
/eBDZA//Qc15ucwrvI0uXk3SqY/sywk0Jac/wGxx5nUrnM1gYoU1jK1JIsJ5ade3
DqwzxVrOZs/Q5/OT/B2thDmW07WFvWyud2LZeGMipc0ztBRzkB6mRPH5uonLR1/y
ACTUuDfPdfiDxdNx5i943FRNe4Yiqk121LMdFzrRfFkbtb9ZlGjZdvBbPjN8U1Bf
9rEfRA8UCnemGMyczI2TJY2lOWix6rbBspHAqCoCxOMazLRRdH8QPYbCCfmBal6K
3yP/ZHA/utVENUOU3QfmmqNHY0/Kkekqr7SIJVjAeFJRQUDoABp0k4FkyxZuHA5H
g9iYM71txAsrZ6Cup+ez6WJlbYRcswOGeB23BhCAjlyGza8deLkd8KeFFa2h1fh0
alYIf4WHOtal5dGNPx6LPvK4uWaTUSqqwG7WeoCZA5U43pDPj9P6G6nzzNaX+NPg
7eF4JzZ0w9/8sD9eB4GxoE22sLvgBFeswc7GRG1iOLmZuRPd6csFjsGRPqVwI+o5
Da6W7uNjlcjDIR4t4BA77j3n40eXCHTACeoLsJZ9/NuTyq3lkv/62WyaiQrB3T9R

apr-util_1.6.3-2_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Mon, 18 Mar 2024 20:21:56 +0100
Source: apr-util
Architecture: source
Version: 1.6.3-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Stefan Fritsch 
Closes: 1066821
Changes:
 apr-util (1.6.3-2) unstable; urgency=medium
 .
   * Incorporate NMU. Thanks to all the 64-bit time_t transition
 people.
   * Bump libapr1-dev Build-Dep to 1.7.2-3.2. Hopefully
 closes: #1066821
   * Add more 64-bit time_t patches from Simon McVittie. Thanks.
 Closes: #1066821
Checksums-Sha1:
 e54da49c48a25eaa47c11c1649122dde4996948d 2790 apr-util_1.6.3-2.dsc
 0a3ba0d15d92ea2a6b4743fa84bcdfcbb9dfb0ac 341028 apr-util_1.6.3-2.debian.tar.xz
 8e751c5f1abc1d5eeb09c253c51e5eca51d74d0d 8920 apr-util_1.6.3-2_source.buildinfo
Checksums-Sha256:
 ec0980c33c48706d28ee3894c543f2f2fe4a6e0f4b7b233f6448205934b2079f 2790 
apr-util_1.6.3-2.dsc
 5dd4abc7e74af270900b953523ee50ebc44bb794fba64a08111f3c1ac9942fb4 341028 
apr-util_1.6.3-2.debian.tar.xz
 0060c54212516ee4f898e3dceff0c339586f6a10f645866b91e28f732a9f1914 8920 
apr-util_1.6.3-2_source.buildinfo
Files:
 2bd4a9312509ac42206b46bbbc4d60ff 2790 libs optional apr-util_1.6.3-2.dsc
 132c383916b36665b64db1820a859540 341028 libs optional 
apr-util_1.6.3-2.debian.tar.xz
 ef4a4a49dd973d32bcce3d1e9f688cbd 8920 libs optional 
apr-util_1.6.3-2_source.buildinfo

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEOpiNza8JqByyYYsxxodfNUHO/eAFAmX4lSIACgkQxodfNUHO
/eBDZA//Qc15ucwrvI0uXk3SqY/sywk0Jac/wGxx5nUrnM1gYoU1jK1JIsJ5ade3
DqwzxVrOZs/Q5/OT/B2thDmW07WFvWyud2LZeGMipc0ztBRzkB6mRPH5uonLR1/y
ACTUuDfPdfiDxdNx5i943FRNe4Yiqk121LMdFzrRfFkbtb9ZlGjZdvBbPjN8U1Bf
9rEfRA8UCnemGMyczI2TJY2lOWix6rbBspHAqCoCxOMazLRRdH8QPYbCCfmBal6K
3yP/ZHA/utVENUOU3QfmmqNHY0/Kkekqr7SIJVjAeFJRQUDoABp0k4FkyxZuHA5H
g9iYM71txAsrZ6Cup+ez6WJlbYRcswOGeB23BhCAjlyGza8deLkd8KeFFa2h1fh0
alYIf4WHOtal5dGNPx6LPvK4uWaTUSqqwG7WeoCZA5U43pDPj9P6G6nzzNaX+NPg
7eF4JzZ0w9/8sD9eB4GxoE22sLvgBFeswc7GRG1iOLmZuRPd6csFjsGRPqVwI+o5
Da6W7uNjlcjDIR4t4BA77j3n40eXCHTACeoLsJZ9/NuTyq3lkv/62WyaiQrB3T9R
LHP+kEhznsxOmYAZS7YUd7HBRRj6ZhyaMYn+2rmrXfsq4cDqzD+zkPhq7g/N0AlT
GMzFjniJz58Dcuy4mml9AJ1L8rk1Nmpc68w3Qa9KymF6faAfVY8=
=N8kz
-END PGP SIGNATURE-



pgpEAXh1vFh10.pgp
Description: PGP signature

Bug#1066821: apr-util: FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 Segmentation fault LD_LIBRARY_PATH="`echo "../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | sed -e 's/

[Stefan Fritsch]

Am 18.03.24 um 19:30 schrieb Stefan Fritsch:


Am 13.03.24 um 22:32 schrieb Sebastian Ramacher:

Source: apr-util
Version: 1.6.3-1.1
Severity: serious
Tags: ftbfs
Justification: fails to build from source (but built successfully in 
the past)

X-Debbugs-Cc: sramac...@debian.org

https://buildd.debian.org/status/fetch.php?pkg=apr-util=armhf=1.6.3-1.1=1709086833=0


It looks to me like it tried to use a non 64bit time_t libapr1 during 
build, which does not work because libapr1 changes abi with the time_t 
transition. Adding a versioned build-depends should help. I will check 
later.


Unfortunately, apr-util build-deps are uninstallable on armhf/armel 
right now due to postgres not being built for 64bit time_t. So, there is 
no easy way to test this. I will upload anyway.

Bug#1066821: apr-util: FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 Segmentation fault LD_LIBRARY_PATH="`echo "../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | sed -e 's/

[Stefan Fritsch]

Am 13.03.24 um 22:32 schrieb Sebastian Ramacher:

Source: apr-util
Version: 1.6.3-1.1
Severity: serious
Tags: ftbfs
Justification: fails to build from source (but built successfully in the past)
X-Debbugs-Cc: sramac...@debian.org

https://buildd.debian.org/status/fetch.php?pkg=apr-util=armhf=1.6.3-1.1=1709086833=0


It looks to me like it tried to use a non 64bit time_t libapr1 during 
build, which does not work because libapr1 changes abi with the time_t 
transition. Adding a versioned build-depends should help. I will check 
later.




testldap:  SUCCESS
testdbd :  SUCCESS
testdate:  SUCCESS
testmemcache:  Error 111 occurred attempting to reach memcached on 
localhost:11211.  Skipping apr_memcache tests...
SUCCESS
testredis   :  Error 111 occurred attempting to reach Redis on 
localhost:6379.  Skipping apr_redis tests...
SUCCESS
testxml :  SUCCESS
testxlate   :  SUCCESS
testrmm :  SUCCESS
testdbm :  BDB1565 DB->put: method not permitted before handle's 
open method
/bin/bash: line 3: 3132384 Segmentation fault  LD_LIBRARY_PATH="`echo 
"../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | sed -e 
's/::*$//'`" ./$prog -v
Programs failed: testall
make[2]: *** [Makefile:60: check] Error 139

Cheers

Bug#1067104: server stalls: AH00046: child process 2876749 still did not exit, sending a SIGKILL

[Yaroslav Halchenko]

Package: apache2
Version: 2.4.57-2
Severity: important

Server was working just fine for years and recently started to stall
completely after 3-7 days of functioning normally.  error logs get filled up
first with AH03490 and then eventually with AH00045 messages:

[Sun Mar 17 02:26:01.353381 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
...
[Sun Mar 17 22:00:42.201774 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Sun Mar 17 22:00:42.995574 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Sun Mar 17 22:00:42.998488 2024] [mpm_event:notice] [pid 2649373:tid 
139846579189632] AH00492: caught SIGWINCH, shutting down gracefully
[Sun Mar 17 22:00:46.358981 2024] [core:warn] [pid 2649373:tid 
139846579189632] AH00045: child process 2649375 still did not exit, sending a 
SIGTERM
[Sun Mar 17 22:00:46.359064 2024] [core:warn] [pid 2649373:tid 
139846579189632] AH00045: child process 2649376 still did not exit, sending a 
SIGTERM

until I restart the beast.

$> grep AH03490 error.log | wc -l
70404
$> grep AH00045 error.log | wc -l
48

Server has a number of virtualserver's configured.
Seems has started about a month ago

$> for e in error.log*; do zgrep AH03490 $e| head -n 1 ; done
[Sun Mar 17 02:26:01.353381 2024] [mpm_event:error] [pid 2649373:tid 
139846579189632] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Mon Mar 11 16:47:41.181900 2024] [mpm_event:error] [pid 1172065:tid 
140192799893376] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Tue Mar 05 00:00:12.307813 2024] [mpm_event:error] [pid 2686718:tid 
139644504094592] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Sun Feb 25 03:23:33.382200 2024] [mpm_event:error] [pid 2686718:tid 
139644504094592] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Sat Feb 24 01:02:29.148887 2024] [mpm_event:error] [pid 2686718:tid 
139644504094592] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.
[Tue Feb 13 14:28:00.653754 2024] [mpm_event:error] [pid 2434335:tid 
140300052350848] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase 
ServerLimit.

and likely after I configured some wsgi

$> zgrep apache /var/log/dpkg.log.* | grep 2024
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 install 
libapache2-mod-python:amd64  3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 status half-installed 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 status unpacked 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 configure 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1 
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 status unpacked 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:34:23 status half-configured 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:34:25 status installed 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:51:18 status installed 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:51:19 remove 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1 
/var/log/dpkg.log.2.gz:2024-02-02 12:51:19 status half-configured 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:51:21 status half-installed 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:51:21 status config-files 
libapache2-mod-python:amd64 3.5.0+git20211031.e6458ec-1+deb12u1
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 install 
libapache2-mod-wsgi-py3:amd64  4.9.4-1+b2
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 status half-installed 
libapache2-mod-wsgi-py3:amd64 4.9.4-1+b2
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 status unpacked 
libapache2-mod-wsgi-py3:amd64 4.9.4-1+b2
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 configure 
libapache2-mod-wsgi-py3:amd64 4.9.4-1+b2 
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 status unpacked 
libapache2-mod-wsgi-py3:amd64 4.9.4-1+b2
/var/log/dpkg.log.2.gz:2024-02-02 12:52:11 status half-configured 
libapache2-mod-wsgi-py3:amd64 4.9.4-1+b2
/var/log/dpkg.log.2.gz:2024-02-02 12:52:14 status installed 
libapache2-mod-wsgi-py3:amd64 

Re: Bug#1067035: apache2-bin: rebuild for the 64-bit time_t migration is uninstallable

[Étienne Mollier]

Hi Simon,

Simon McVittie, on 2024-03-17:
> I believe the attached patches should fix this (untested). After fixing
> this in apr-util, apache2 will need a binNMU (or a re-upload).

Thanks for your patches, I confirm they resolve the dependency
issue after a rebuild of apache2.  libaprutil164 without 't' is
no more present in the dependencies.

Have a nice day,  :)
-- 
  .''`.  Étienne Mollier 
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/1, please excuse my verbosity
   `-


signature.asc
Description: PGP signature

Processed: Re: Bug#1067035: apache2-bin: rebuild for the 64-bit time_t migration is uninstallable

[Debian Bug Tracking System]

Processing control commands:

> reassign -1 libaprutil1t64
Bug #1067035 [apache2-bin] apache2-bin: rebuild for the 64-bit time_t migration 
is uninstallable
Bug reassigned from package 'apache2-bin' to 'libaprutil1t64'.
No longer marked as found in versions apache2/2.4.58-1.
Ignoring request to alter fixed versions of bug #1067035 to the same values 
previously set
> found -1 1.6.3-1.1
Bug #1067035 [libaprutil1t64] apache2-bin: rebuild for the 64-bit time_t 
migration is uninstallable
Marked as found in versions apr-util/1.6.3-1.1.
> affects -1 + apache2-bin
Bug #1067035 [libaprutil1t64] apache2-bin: rebuild for the 64-bit time_t 
migration is uninstallable
Added indication that 1067035 affects apache2-bin
> tags -1 + patch
Bug #1067035 [libaprutil1t64] apache2-bin: rebuild for the 64-bit time_t 
migration is uninstallable
Added tag(s) patch.

-- 
1067035: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067035
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Re: Bug#1067035: apache2-bin: rebuild for the 64-bit time_t migration is uninstallable

[Simon McVittie]

Control: reassign -1 libaprutil1t64
Control: found -1 1.6.3-1.1
Control: affects -1 + apache2-bin
Control: tags -1 + patch

On Sun, 17 Mar 2024 at 12:01:38 +0100, Étienne Mollier wrote:
> libaprutil164 (note the missing 't' for "t64") is not available
> in unstable.  The dependency looks typoed and duplicated, as
> libaprutil1t64 (>= 1.6.0) is also present as needed in the
> Depends field,

If I'm reading correctly, this is a bug in the NMU of libaprutil1t64 with
the rename for 64-bit time_t, not a bug in apache2-bin. The .symbols
file in libaprutil1t64 generates dependencies on a nonexistent package
name if functions related to LDAP or database functionality are used.

I believe the attached patches should fix this (untested). After fixing
this in apr-util, apache2 will need a binNMU (or a re-upload).

I have not attempted to fix apr-util's other RC bug, #1066821.

smcv
>From e36a8c4784278ccfb32d112b57cd2260fedb2e3c Mon Sep 17 00:00:00 2001
From: Simon McVittie 
Date: Sun, 17 Mar 2024 13:21:29 +
Subject: [PATCH 2/3] d/libaprutil1t64.symbols: Fix name of t64 binary package

It's libaprutil1t64 (with the "t"), not libaprutil164.

Closes: #1067035
---
 debian/libaprutil1t64.symbols | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/libaprutil1t64.symbols b/debian/libaprutil1t64.symbols
index 8468461..0b6493b 100644
--- a/debian/libaprutil1t64.symbols
+++ b/debian/libaprutil1t64.symbols
@@ -1,6 +1,6 @@
 libaprutil-1.so.0 libaprutil1t64 #MINVER#
-| libaprutil1-ldap , libaprutil164 #MINVER#
-| libaprutil1-dbd-sqlite3|libaprutil1-dbd-mysql|libaprutil1-dbd-odbc|libaprutil1-dbd-pgsql|libaprutil1-dbd-freetds , libaprutil164 #MINVER#
+| libaprutil1-ldap , libaprutil1t64 #MINVER#
+| libaprutil1-dbd-sqlite3|libaprutil1-dbd-mysql|libaprutil1-dbd-odbc|libaprutil1-dbd-pgsql|libaprutil1-dbd-freetds , libaprutil1t64 #MINVER#
  _crypt_blowfish_rn@Base 1.5.0
  _crypt_gensalt_blowfish_rn@Base 1.5.0
  _crypt_output_magic@Base 1.5.0
-- 
2.43.0

>From 1ea1785071067c436b9e0b1938fbc2553e849d3f Mon Sep 17 00:00:00 2001
From: Simon McVittie 
Date: Sun, 17 Mar 2024 13:22:27 +
Subject: [PATCH 3/3] d/libaprutil1t64.lintian-overrides: Remove unnecessary
 lintian override

---
 debian/libaprutil1t64.lintian-overrides | 1 -
 1 file changed, 1 deletion(-)

diff --git a/debian/libaprutil1t64.lintian-overrides b/debian/libaprutil1t64.lintian-overrides
index 90a6b4d..fb2f313 100644
--- a/debian/libaprutil1t64.lintian-overrides
+++ b/debian/libaprutil1t64.lintian-overrides
@@ -1,3 +1,2 @@
 libaprutil1t64: symbols-declares-dependency-on-other-package
 libaprutil1t64: package-name-doesnt-match-sonames libaprutil-1-0
-libaprutil1t64: package-name-doesnt-match-sonames libaprutil1
-- 
2.43.0

Bug#1067035: apache2-bin: rebuild for the 64-bit time_t migration is uninstallable

[Étienne Mollier]

Package: apache2-bin
Version: 2.4.58-1+b2
Severity: serious
Justification: uninstallable

Dear Maintainer,

Attempting to upgrade apache2-bin from rebuild 2.4.58-1+b1 to
the rebuild 2.4.58-1+b2 leads to the following error:

$ sudo apt upgrade apache2-bin
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 apache2-bin : Depends: libaprutil164 (>= 1.2.7+dfsg) but it is not 
installable
E: Broken packages

libaprutil164 (note the missing 't' for "t64") is not available
in unstable.  The dependency looks typoed and duplicated, as
libaprutil1t64 (>= 1.6.0) is also present as needed in the
Depends field,

Otherwise, have a nice Sunday,  :)
Étienne.


-- Package-specific info:

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.7.9-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2-bin depends on:
ii  libapr1t64 [libapr1]  1.7.2-3.2
ii  libaprutil1-dbd-sqlite3   1.6.3-1.1+b1
ii  libaprutil1-ldap  1.6.3-1.1+b1
ii  libaprutil1t64 [libaprutil1]  1.6.3-1.1+b1
ii  libbrotli11.1.0-2+b3
ii  libc6 2.37-15.1
ii  libcrypt1 1:4.4.36-4
ii  libcurl4t64 [libcurl4]8.6.0-4
ii  libjansson4   2.14-2+b2
ii  libldap-2.5-0 2.5.16+dfsg-2
ii  liblua5.3-0   5.3.6-2+b2
ii  libnghttp2-14 1.59.0-1+b1
ii  libpcre2-8-0  10.42-4+b1
ii  libssl3t64 [libssl3]  3.1.5-1.1
ii  libxml2   2.9.14+dfsg-1.3+b2
ii  perl  5.38.2-3.2
ii  zlib1g1:1.3.dfsg-3.1

apache2-bin recommends no packages.

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  firefox-esr [www-browser]115.8.0esr-1+b1
ii  lynx [www-browser]   2.9.0rel.0-2+b1
ii  surf [www-browser]   2.1+git20221016-6+b1
ii  w3m [www-browser]0.5.3+git20230121-2+b3

Versions of packages apache2 depends on:
ii  apache2-data 2.4.58-1
ii  apache2-utils2.4.58-1+b1
ii  init-system-helpers  1.66
ii  media-types  10.1.0
ii  perl 5.38.2-3.2
ii  procps   2:4.0.4-4

Versions of packages apache2 recommends:
ii  ssl-cert  1.1.2

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  firefox-esr [www-browser]115.8.0esr-1+b1
ii  lynx [www-browser]   2.9.0rel.0-2+b1
ii  surf [www-browser]   2.1+git20221016-6+b1
ii  w3m [www-browser]0.5.3+git20230121-2+b3

Versions of packages apache2-bin is related to:
ii  apache2  2.4.58-1+b1
ii  apache2-bin  2.4.58-1+b1

-- no debconf information

-- 
  .''`.  Étienne Mollier 
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/4, please excuse my verbosity
   `-on air: Antony Kalugin - Key


signature.asc
Description: PGP signature

Processed: reassign 1067031 to src:apache2

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> reassign 1067031 src:apache2
Bug #1067031 [src:apache2-bin] apache2-bin: Probably wrong dependency.
Warning: Unknown package 'src:apache2-bin'
Bug reassigned from package 'src:apache2-bin' to 'src:apache2'.
No longer marked as found in versions apache2-bin/2.4.58-1.
Ignoring request to alter fixed versions of bug #1067031 to the same values 
previously set
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1067031: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067031
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

reassign 1067031 to src:apache2

[Martin Dosch]

reassign 1067031 src:apache2 
thanks



signature.asc
Description: PGP signature

Bug#1064950: marked as done (apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.)

[Debian Bug Tracking System]

Your message dated Wed, 13 Mar 2024 22:29:55 +0100
with message-id 
and subject line Re: AW: AW: Bug#1064950: apache2: (Legacy?) "Depends: 
apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.
has caused the Debian Bug report #1064950,
regarding apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in 
debian/control breaks binNMU builds.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1064950: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064950
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Subject: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in 
debian/control breaks binNMU builds.
Source: apache2
X-Debbugs-Cc: christof.warl...@siemens.com
Version: 2.4.57-2
Severity: serious
Justification: fails to build from source (but built successfully in the past)
Tags: patch ftbfs

Dear Maintainer,

(re)building apache2 as binNMU (i.e. with appending "+b to the 
package version")
works, but installation of the resulting apache2 package fails due to the 
following dependency
in debian/control:

Depends: apache2-data (= ${source:Version}),

It causes apt-get to look for the dependency "apache2-data" (= 2.4.57-2) which 
does not exist
in the newly built packages. Instead, the dependency should be satisfied by
"apache2-data (= 2.4.57-2+b)".

The folliwing patch fixes the issue:

diff --git a/debian/control b/debian/control
index 2eddc60..31121fa 100644
--- a/debian/control
+++ b/debian/control
@@ -34,7 +34,7 @@ Rules-Requires-Root: binary-targets
 Package: apache2
 Architecture: any
 Depends: apache2-bin (= ${binary:Version}),
- apache2-data (= ${source:Version}),
+ apache2-data (= ${binary:Version}),
  apache2-utils (= ${binary:Version}),
  lsb-base,
  media-types,

Please consider applying the patch.

Best regards,

Christof Warlich

P.S.: Note that the information below, being produced by "reportbug", is 
irrelevant as I executed "reportbug"
on WSL2 on Windows 10. The actual Debian version is "bookworm".

-- System Information:
Debian Release: bookworm/sid
  APT prefers jammy-updates
  APT policy: (500, 'jammy-updates'), (500, 'jammy-security'), (500, 'jammy'), 
(100, 'jammy-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.102.1-microsoft-standard-WSL2+ (SMP w/16 CPU threads)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
On 2024-03-04 12:33:39 +, Warlich, Christof wrote:
> Sebastian Ramacher wrote:
> > Christof Warlich wrote:
> > > If this assumption is true, then why is the Debian build system (i.e. 
> > > dpkg-buildpackage) not smart enough to simply ignore an existing +bX 
> > > extension for Architecture: all binary packages? IMHO, this would 
> > > simplify matters, as it would have avoided the pitfall that I stumbled 
> > > into altogether.
> > 
> > binNMUs are handled a layer above. sbuild will pass the correct options to 
> > dpkg-buildpackage to build binNMUs. If you are interested in having binNMU 
> > builds for your own infrastructure, you'll probably need to take a look at 
> > the sbuild source to see how it is implemented.
> 
> Ok, so I'd better start using sbuild instead. Again, thanks for the valuable 
> info and your time.

Closing this bug.

Cheers
-- 
Sebastian Ramacher--- End Message ---

Bug#1066821: apr-util: FTBFS on arm{el,hf}: /bin/bash: line 3: 3132384 Segmentation fault LD_LIBRARY_PATH="`echo "../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | sed -

[Sebastian Ramacher]

Source: apr-util
Version: 1.6.3-1.1
Severity: serious
Tags: ftbfs
Justification: fails to build from source (but built successfully in the past)
X-Debbugs-Cc: sramac...@debian.org

https://buildd.debian.org/status/fetch.php?pkg=apr-util=armhf=1.6.3-1.1=1709086833=0

testldap:  SUCCESS
testdbd :  SUCCESS
testdate:  SUCCESS
testmemcache:  Error 111 occurred attempting to reach memcached on 
localhost:11211.  Skipping apr_memcache tests...
SUCCESS
testredis   :  Error 111 occurred attempting to reach Redis on 
localhost:6379.  Skipping apr_redis tests...
SUCCESS
testxml :  SUCCESS
testxlate   :  SUCCESS
testrmm :  SUCCESS
testdbm :  BDB1565 DB->put: method not permitted before handle's 
open method
/bin/bash: line 3: 3132384 Segmentation fault  LD_LIBRARY_PATH="`echo 
"../crypto/.libs:../dbm/.libs:../dbd/.libs:../ldap/.libs:$LD_LIBRARY_PATH" | 
sed -e 's/::*$//'`" ./$prog -v
Programs failed: testall
make[2]: *** [Makefile:60: check] Error 139

Cheers
-- 
Sebastian Ramacher

Processing of apr_1.7.2-3.2_source.changes

[Debian FTP Masters]

apr_1.7.2-3.2_source.changes uploaded successfully to localhost
along with the files:
  apr_1.7.2-3.2.dsc
  apr_1.7.2-3.2.debian.tar.xz
  apr_1.7.2-3.2_source.buildinfo

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

apr_1.7.2-3.2_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Fri, 08 Mar 2024 19:11:28 +
Source: apr
Architecture: source
Version: 1.7.2-3.2
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers 
Changed-By: Steve Langasek 
Changes:
 apr (1.7.2-3.2) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix symbols files which are in a non-standard location.
Checksums-Sha1:
 fb88873fd02f6cb033899f0b060aa89f4509d0d1 2323 apr_1.7.2-3.2.dsc
 2afdfaa223f31b8a53e32576ca32099719f93923 54572 apr_1.7.2-3.2.debian.tar.xz
 3aa990b1e6ec1c3271deee5649296e06d75915ac 6624 apr_1.7.2-3.2_source.buildinfo
Checksums-Sha256:
 e6beb42d176608fce031f271017b650658c633f5e31080047541b9549ee2715a 2323 
apr_1.7.2-3.2.dsc
 0758509e6cda3f6f3f367e84e8ef1c05d58450936f78f4163f22b0df8a663a6c 54572 
apr_1.7.2-3.2.debian.tar.xz
 d38edbb4561165638906f9400f639605e5377ecebfeadab3daca4c6b5174695b 6624 
apr_1.7.2-3.2_source.buildinfo
Files:
 6ac8fd144b7f5db1d7802d5e9134036f 2323 libs optional apr_1.7.2-3.2.dsc
 c9647dce37ec9a3508da952ea1dd2af5 54572 libs optional 
apr_1.7.2-3.2.debian.tar.xz
 bb157860a4bdc6b47e63fa49418a8ccd 6624 libs optional 
apr_1.7.2-3.2_source.buildinfo

-BEGIN PGP SIGNATURE-

iQJGBAEBCgAwFiEErEg/aN5yj0PyIC/KVo0w8yGyEz0FAmXrYzISHHZvcmxvbkBk
ZWJpYW4ub3JnAAoJEFaNMPMhshM9DhkP+QFBy+jsislWylMJnb34Cv2NrEpKRnHD
vp+OA01hIKiNz834LZDq6/bza8A1RwUu208twVZzm5dl+yAlOwSDDOOzJjjtnu7z
XOOEHEsNGlkgsksdsO6bSGxahePuAo1QRG+lZL7O5iXWsqRFQZcThkmTWFyMJuBr
/lqlXsVDmci560Binc3KTpAXSAJgj3vhwdtGYxh68DRHSrU52CBUABH+AccFnDA7
kbZqUu01U2IsI3ab9XN6Ddr2nqh0r3qjZsy3CYNQtTfFwrkdSlt/xDWq3iGefLpm
KJiiTaHJSB+uqN4MRfqt85ZtNA46+eGHNnH/WIwkmtCnA4vAlOTE3K1IYDSohwa6
CYz0b7oUdaMeuaOfM9pGkVDeWnM+sJ4KiPi3cI/C/i4ZGyPZI38BSJ7ALqEIP8/z
hu1cLqU/CRbtVt1f+XSo9lpUmDvEeYDaNSg4aSoPufeyOU7KCbYb3bkcm6apO2mn
8pWqaiDjYOyLMgUSkMCE5EpewFwb9dTCQviZaw6EiAGQBs8GGSgqXW8bJr5U/GAp
hEjzfSkd9sMy2uCQhYxj/ZAVPwHadzIO2hqCBxbYWQ/kG11aBtZzuXtM4/vnqqRX
63mFopF/TzZF3+YErHRCtIwGEm8IvKDcZ9QMFu1vZp/2yqd4vw1rwhogOnYy+a6f
30rtKmxTSsEW
=uX7W
-END PGP SIGNATURE-



pgpDri9Ve702H.pgp
Description: PGP signature

Bug#1061894: apr: NMU diff for 64-bit time_t transition

[Steve Langasek]

The NMU was buggy because symbols files are in a non-standard location, so
did not get updated by our transition scripts; with the result that packages
rebuilt against libapr1t64 still had a dependency on libapr1.  Please find
attached a full NMU debdiff for an updated NMU.

On Wed, Feb 28, 2024 at 01:17:59AM +, Steve Langasek wrote:
> Dear maintainer,
> 
> Please find attached a final version of this patch for the time_t
> transition.  This patch is being uploaded to unstable.
> 
> Note that this adds a versioned build-dependency on dpkg-dev, to guard
> against accidental backports with a wrong ABI.
> 
> Thanks!
> 
> 
> -- System Information:
> Debian Release: trixie/sid
>   APT prefers unstable
>   APT policy: (500, 'unstable'), (1, 'experimental')
> Architecture: amd64 (x86_64)
> 
> Kernel: Linux 6.5.0-14-generic (SMP w/12 CPU threads; PREEMPT)
> Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
> Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)

> diff -Nru apr-1.7.2/debian/changelog apr-1.7.2/debian/changelog
> --- apr-1.7.2/debian/changelog2023-02-26 20:51:24.0 +
> +++ apr-1.7.2/debian/changelog2024-02-28 01:17:18.0 +
> @@ -1,3 +1,10 @@
> +apr (1.7.2-3.1) unstable; urgency=medium
> +
> +  * Non-maintainer upload.
> +  * Rename libraries for 64-bit time_t transition.  Closes: #1061894
> +
> + -- Steve Langasek   Wed, 28 Feb 2024 01:17:18 +
> +
>  apr (1.7.2-3) unstable; urgency=medium
>  
>* Add more fixes for atomics from upstream, in particular for
> diff -Nru apr-1.7.2/debian/control apr-1.7.2/debian/control
> --- apr-1.7.2/debian/control  2023-02-03 16:18:13.0 +
> +++ apr-1.7.2/debian/control  2024-02-28 01:17:18.0 +
> @@ -3,7 +3,7 @@
>  Priority: optional
>  Maintainer: Debian Apache Maintainers 
>  Uploaders: Stefan Fritsch 
> -Build-Depends: debhelper-compat (= 13),
> +Build-Depends: dpkg-dev (>= 1.22.5), debhelper-compat (= 13),
>   autoconf,
>   mawk,
>   uuid-dev,
> @@ -19,7 +19,10 @@
>  Homepage: https://apr.apache.org/
>  Rules-Requires-Root: no
>  
> -Package: libapr1
> +Package: libapr1t64
> +Provides: ${t64:Provides}
> +Replaces: libapr1
> +Breaks: libapr1 (<< ${source:Version})
>  Architecture: any
>  Depends: ${shlibs:Depends}, ${misc:Depends}
>  Pre-Depends: ${misc:Pre-Depends}
> @@ -33,7 +36,7 @@
>  Package: libapr1-dev
>  Architecture: any
>  Section: libdevel
> -Depends: libapr1 (= ${binary:Version}), uuid-dev, ${misc:Depends}, 
> libsctp-dev [linux-any], python3:any
> +Depends: libapr1t64 (= ${binary:Version}), uuid-dev, ${misc:Depends}, 
> libsctp-dev [linux-any], python3:any
>  Conflicts: libapr1.0-dev, libapr0-dev
>  Description: Apache Portable Runtime Library - Development Headers
>   APR is Apache's Portable Runtime Library, designed to be a support library
> diff -Nru apr-1.7.2/debian/libapr1.docs apr-1.7.2/debian/libapr1.docs
> --- apr-1.7.2/debian/libapr1.docs 2023-02-02 21:18:42.0 +
> +++ apr-1.7.2/debian/libapr1.docs 1970-01-01 00:00:00.0 +
> @@ -1 +0,0 @@
> -NOTICE
> diff -Nru apr-1.7.2/debian/libapr1.install apr-1.7.2/debian/libapr1.install
> --- apr-1.7.2/debian/libapr1.install  2023-02-02 21:18:42.0 +
> +++ apr-1.7.2/debian/libapr1.install  1970-01-01 00:00:00.0 +
> @@ -1 +0,0 @@
> -usr/lib/*/libapr-1.so.*
> diff -Nru apr-1.7.2/debian/libapr1.lintian-overrides 
> apr-1.7.2/debian/libapr1.lintian-overrides
> --- apr-1.7.2/debian/libapr1.lintian-overrides2023-02-02 
> 21:18:42.0 +
> +++ apr-1.7.2/debian/libapr1.lintian-overrides1970-01-01 
> 00:00:00.0 +
> @@ -1 +0,0 @@
> -libapr1: package-name-doesnt-match-sonames libapr-1-0
> diff -Nru apr-1.7.2/debian/libapr1.symbols apr-1.7.2/debian/libapr1.symbols
> --- apr-1.7.2/debian/libapr1.symbols  2023-02-02 21:18:42.0 +
> +++ apr-1.7.2/debian/libapr1.symbols  1970-01-01 00:00:00.0 +
> @@ -1,2 +0,0 @@
> -here for the purpose of tricking debhelper...bwahahahaha.
> -
> diff -Nru apr-1.7.2/debian/libapr1t64.docs apr-1.7.2/debian/libapr1t64.docs
> --- apr-1.7.2/debian/libapr1t64.docs  1970-01-01 00:00:00.0 +
> +++ apr-1.7.2/debian/libapr1t64.docs  2023-02-02 21:18:42.0 +
> @@ -0,0 +1 @@
> +NOTICE
> diff -Nru apr-1.7.2/debian/libapr1t64.install 
> apr-1.7.2/debian/libapr1t64.install
> --- apr-1.7.2/debian/libapr1t64.install   1970-01-01 00:00:00.0 
> +
> +++ apr-1.7.2/debian/libapr1t64.install   2023-02-02 21:18:42.0 
> +
> @@ -0,0 +1 @@
> +usr/lib/*/libapr-1.so.*
> diff -Nru apr-1.7.2/debian/libapr1t64.lintian-overrides 
> apr-1.7.2/debian/libapr1t64.lintian-overrides
> --- apr-1.7.2/debian/libapr1t64.lintian-overrides 1970-01-01 
> 00:00:00.0 +
> +++ apr-1.7.2/debian/libapr1t64.lintian-overrides 2024-02-28 
> 01:17:10.0 +
> @@ -0,0 

Re: Need Some Help

[Yadd]

On 3/7/24 20:52, Ali Ramzan wrote:

Hi,

I am currently using Debian Apache version on my Debian server, but when 
I perform a scan, I am alerted to several vulnerabilities. Specifically, 
the Apache version 2.4.x is vulnerable to multiple CVEs, including 
2023-31122, 2023-43622, and 2023-45802.


I have a couple of questions: When will Debian release Apache version 
2.4.58, which resolves these vulnerabilities? Also, where can I find a 
link to this release and its release date? Finally, is there any way for 
me to fix these vulnerabilities in the meantime?


Hi,

version 2.4.58 doesn't contain important CVE fixes, only minor/medium. 
So it will be updated during a Debian point release and not in security 
branch.


Cheers,
Yadd

Need Some Help

[Ali Ramzan]

Hi,

I am currently using Debian Apache version on my Debian server, but when I
perform a scan, I am alerted to several vulnerabilities. Specifically, the
Apache version 2.4.x is vulnerable to multiple CVEs, including 2023-31122,
2023-43622, and 2023-45802.

I have a couple of questions: When will Debian release Apache version
2.4.58, which resolves these vulnerabilities? Also, where can I find a link
to this release and its release date? Finally, is there any way for me to
fix these vulnerabilities in the meantime?

apt policy apache2
apache2:
  Installed: 2.4.56-1~deb11u2
  Candidate: 2.4.56-1~deb11u2
  Version table:
 *** 2.4.56-1~deb11u2 500
500 http://ftp.de.debian.org/debian bullseye/main amd64 Packages
100 /var/lib/dpkg/status
root@vcloudproxy-02:~# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:Debian GNU/Linux 11 (bullseye)
Release:11
Codename:   bullseye

Thanks
Ali

Bug#1064950: AW: AW: Bug#1064950: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.

[Warlich, Christof]

Sebastian Ramacher wrote:
> Christof Warlich wrote:
> > If this assumption is true, then why is the Debian build system (i.e. 
> > dpkg-buildpackage) not smart enough to simply ignore an existing +bX 
> > extension for Architecture: all binary packages? IMHO, this would simplify 
> > matters, as it would have avoided the pitfall that I stumbled into 
> > altogether.
> 
> binNMUs are handled a layer above. sbuild will pass the correct options to 
> dpkg-buildpackage to build binNMUs. If you are interested in having binNMU 
> builds for your own infrastructure, you'll probably need to take a look at 
> the sbuild source to see how it is implemented.

Ok, so I'd better start using sbuild instead. Again, thanks for the valuable 
info and your time.

Bug#1064950: AW: Bug#1064950: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.

[Sebastian Ramacher]

On 2024-03-04 06:19:58 +, Warlich, Christof wrote:
> Sebastian Ramacher wrote:
> > This is wrong. apache2-data is an Architecture: all package,
> > but apache2 is Architecture: any. So using ${source:Version}
> > here is correct. Note that Debian does not currently support
> > binNMUs for Architecture: all packages, so apache2-data will
> > never have a +bX version.
> 
> Thanks for that clarification.
> 
> This is somewhat confusing for someone not doing package builds as a daily 
> profession: If just doing a "dpkg-buildpackage -us -uc" on the apache2 
> sources _with_ the +bX extension, the apache2-data binary package _does_ get 
> the +bX extension as well, at least with my build, causing the issue that I 
> described initially.

For binNMUs you'll need to pass "-B" at least, but see below.

> Thus, as much as I think I've leaned so far, binNMU builds on source packages 
> that also produce Architekture: all binary packages must always be built 
> separately from sources without the +bX extension for the Architecture: all 
> binary packages, whereras the architecture-dependent binary packages may be 
> built from a source package with a +bX extension, right?

Not exactly. The source packages are not changed for binNMUs. This is
handled via sbuild's --binNMU-* options to set the changelog and the
version. Specifically, these options imply that Arch: all binaries are
not built.

> If this assumption is true, then why is the Debian build system (i.e. 
> dpkg-buildpackage) not smart enough to simply ignore an existing +bX 
> extension for Architecture: all binary packages? IMHO, this would simplify 
> matters, as it would have avoided the pitfall that I stumbled into altogether.

binNMUs are handled a layer above. sbuild will pass the correct options
to dpkg-buildpackage to build binNMUs. If you are interested in having
binNMU builds for your own infrastructure, you'll probably need to take
a look at the sbuild source to see how it is implemented.

Cheers
-- 
Sebastian Ramacher

Bug#1064950: AW: Bug#1064950: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.

[Warlich, Christof]

Sebastian Ramacher wrote:
> This is wrong. apache2-data is an Architecture: all package,
> but apache2 is Architecture: any. So using ${source:Version}
> here is correct. Note that Debian does not currently support
> binNMUs for Architecture: all packages, so apache2-data will
> never have a +bX version.

Thanks for that clarification.

This is somewhat confusing for someone not doing package builds as a daily 
profession: If just doing a "dpkg-buildpackage -us -uc" on the apache2 sources 
_with_ the +bX extension, the apache2-data binary package _does_ get the +bX 
extension as well, at least with my build, causing the issue that I described 
initially.

Thus, as much as I think I've leaned so far, binNMU builds on source packages 
that also produce Architekture: all binary packages must always be built 
separately from sources without the +bX extension for the Architecture: all 
binary packages, whereras the architecture-dependent binary packages may be 
built from a source package with a +bX extension, right?

If this assumption is true, then why is the Debian build system (i.e. 
dpkg-buildpackage) not smart enough to simply ignore an existing +bX extension 
for Architecture: all binary packages? IMHO, this would simplify matters, as it 
would have avoided the pitfall that I stumbled into altogether.

Please note that I my main goal is to better understand how to do it right for 
future builds.

Bug#1064950: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.

[Sebastian Ramacher]

On 2024-02-28 07:16:07 +, Warlich, Christof wrote:
> Subject: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in 
> debian/control breaks binNMU builds.
> Source: apache2
> X-Debbugs-Cc: christof.warl...@siemens.com
> Version: 2.4.57-2
> Severity: serious
> Justification: fails to build from source (but built successfully in the past)
> Tags: patch ftbfs
> 
> Dear Maintainer,
> 
> (re)building apache2 as binNMU (i.e. with appending "+b to the 
> package version")
> works, but installation of the resulting apache2 package fails due to the 
> following dependency
> in debian/control:
> 
> Depends: apache2-data (= ${source:Version}),
> 
> It causes apt-get to look for the dependency "apache2-data" (= 2.4.57-2) 
> which does not exist
> in the newly built packages. Instead, the dependency should be satisfied by
> "apache2-data (= 2.4.57-2+b)".
> 
> The folliwing patch fixes the issue:
> 
> diff --git a/debian/control b/debian/control
> index 2eddc60..31121fa 100644
> --- a/debian/control
> +++ b/debian/control
> @@ -34,7 +34,7 @@ Rules-Requires-Root: binary-targets
>  Package: apache2
>  Architecture: any
>  Depends: apache2-bin (= ${binary:Version}),
> - apache2-data (= ${source:Version}),
> + apache2-data (= ${binary:Version}),
>   apache2-utils (= ${binary:Version}),
>   lsb-base,
>   media-types,
> 
> Please consider applying the patch.

This is wrong. apache2-data is an Architecture: all package, but apache2
is Architecture: any. So using ${source:Version} here is correct. Note
that Debian does not currently support binNMUs for Architecture: all
packages, so apache2-data will never have a +bX version.

Cheers

> 
> Best regards,
> 
> Christof Warlich
> 
> P.S.: Note that the information below, being produced by "reportbug", is 
> irrelevant as I executed "reportbug"
> on WSL2 on Windows 10. The actual Debian version is "bookworm".
> 
> -- System Information:
> Debian Release: bookworm/sid
>   APT prefers jammy-updates
>   APT policy: (500, 'jammy-updates'), (500, 'jammy-security'), (500, 
> 'jammy'), (100, 'jammy-backports')
> Architecture: amd64 (x86_64)
> 
> Kernel: Linux 5.10.102.1-microsoft-standard-WSL2+ (SMP w/16 CPU threads)
> Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)

-- 
Sebastian Ramacher

apache2_2.4.58-2_sourceonly.changes REJECTED

[Debian FTP Masters]

apache2 source: lintian output: 'not-binnmuable-any-depends-all apache2 -> 
apache2-data', automatically rejected package.
apache2 source: If you have a good reason, you may override this lintian tag.



===

Please feel free to respond to this email if you don't understand why
your files were rejected, or if you upload new files which address our
concerns.



pgpfQaPlmvLga.pgp
Description: PGP signature

Processing of apache2_2.4.58-2_sourceonly.changes

[Debian FTP Masters]

apache2_2.4.58-2_sourceonly.changes uploaded successfully to localhost
along with the files:
  apache2_2.4.58-2.dsc
  apache2_2.4.58-2.debian.tar.xz

Greetings,

Your Debian queue daemon (running on host usper.debian.org)

Processed: Bug#1064950 marked as pending in apache2

[Debian Bug Tracking System]

Processing control commands:

> tag -1 pending
Bug #1064950 [src:apache2] apache2: (Legacy?) "Depends: apache2-data (= 
${source:Version})," in debian/control breaks binNMU builds.
Added tag(s) pending.

-- 
1064950: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064950
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#1064950: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in debian/control breaks binNMU builds.

[Warlich, Christof]

Subject: apache2: (Legacy?) "Depends: apache2-data (= ${source:Version})," in 
debian/control breaks binNMU builds.
Source: apache2
X-Debbugs-Cc: christof.warl...@siemens.com
Version: 2.4.57-2
Severity: serious
Justification: fails to build from source (but built successfully in the past)
Tags: patch ftbfs

Dear Maintainer,

(re)building apache2 as binNMU (i.e. with appending "+b to the 
package version")
works, but installation of the resulting apache2 package fails due to the 
following dependency
in debian/control:

Depends: apache2-data (= ${source:Version}),

It causes apt-get to look for the dependency "apache2-data" (= 2.4.57-2) which 
does not exist
in the newly built packages. Instead, the dependency should be satisfied by
"apache2-data (= 2.4.57-2+b)".

The folliwing patch fixes the issue:

diff --git a/debian/control b/debian/control
index 2eddc60..31121fa 100644
--- a/debian/control
+++ b/debian/control
@@ -34,7 +34,7 @@ Rules-Requires-Root: binary-targets
 Package: apache2
 Architecture: any
 Depends: apache2-bin (= ${binary:Version}),
- apache2-data (= ${source:Version}),
+ apache2-data (= ${binary:Version}),
  apache2-utils (= ${binary:Version}),
  lsb-base,
  media-types,

Please consider applying the patch.

Best regards,

Christof Warlich

P.S.: Note that the information below, being produced by "reportbug", is 
irrelevant as I executed "reportbug"
on WSL2 on Windows 10. The actual Debian version is "bookworm".

-- System Information:
Debian Release: bookworm/sid
  APT prefers jammy-updates
  APT policy: (500, 'jammy-updates'), (500, 'jammy-security'), (500, 'jammy'), 
(100, 'jammy-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.102.1-microsoft-standard-WSL2+ (SMP w/16 CPU threads)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Bug#1061893: marked as done (apr-util: NMU diff for 64-bit time_t transition)

[Debian Bug Tracking System]

Your message dated Wed, 28 Feb 2024 02:05:20 +
with message-id 
and subject line Bug#1061893: fixed in apr-util 1.6.3-1.1
has caused the Debian Bug report #1061893,
regarding apr-util: NMU diff for 64-bit time_t transition
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1061893: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061893
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: apr-util
Version: 1.6.3-1
Severity: serious
Tags: patch pending
Justification: library ABI skew on upgrade
User: debian-...@lists.debian.org
Usertags: time-t

Dear maintainer,

As part of the 64-bit time_t transition required to support 32-bit
architectures in 2038 and beyond
(https://wiki.debian.org/ReleaseGoals/64bit-time), we have identified
apr-util as a source package shipping runtime libraries whose ABI
either is affected by the change in size of time_t, or could not be
analyzed via abi-compliance-checker (and therefore to be on the safe
side we assume is affected).

To ensure that inconsistent combinations of libraries with their
reverse-dependencies are never installed together, it is necessary to
have a library transition, which is most easily done by renaming the
runtime library package.

Since turning on 64-bit time_t is being handled centrally through a change
to the default dpkg-buildflags (https://bugs.debian.org/1037136), it is
important that libraries affected by this ABI change all be uploaded close
together in time.  Therefore I have prepared a 0-day NMU for apr-util
which will initially be uploaded to experimental if possible, then to
unstable after packages have cleared binary NEW.

Please find the patch for this NMU attached.

If you have any concerns about this patch, please reach out ASAP.  Although
this package will be uploaded to experimental immediately, there will be a
period of several days before we begin uploads to unstable; so if information
becomes available that your package should not be included in the transition,
there is time for us to amend the planned uploads.



-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.5.0-14-generic (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru apr-util-1.6.3/debian/changelog apr-util-1.6.3/debian/changelog
--- apr-util-1.6.3/debian/changelog 2023-02-03 20:15:18.0 +
+++ apr-util-1.6.3/debian/changelog 2024-01-30 00:55:31.0 +
@@ -1,3 +1,10 @@
+apr-util (1.6.3-1.1) experimental; urgency=medium
+
+  * Non-maintainer upload.
+  * Rename libraries for 64-bit time_t transition.
+
+ -- Steve Langasek   Tue, 30 Jan 2024 00:55:31 +
+
 apr-util (1.6.3-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
diff -Nru apr-util-1.6.3/debian/control apr-util-1.6.3/debian/control
--- apr-util-1.6.3/debian/control   2023-02-02 22:42:28.0 +
+++ apr-util-1.6.3/debian/control   2024-01-30 00:55:31.0 +
@@ -22,7 +22,10 @@
 Vcs-Git: https://salsa.debian.org/apache-team/apr-util.git
 Homepage: https://apr.apache.org/
 
-Package: libaprutil1
+Package: libaprutil1t64
+Provides: ${t64:Provides}
+Replaces: libaprutil1
+Breaks: libaprutil1 (<< ${source:Version})
 Architecture: any
 Multi-Arch: same
 Depends: ${shlibs:Depends},
diff -Nru apr-util-1.6.3/debian/libaprutil1.docs 
apr-util-1.6.3/debian/libaprutil1.docs
--- apr-util-1.6.3/debian/libaprutil1.docs  2023-02-01 21:35:51.0 
+
+++ apr-util-1.6.3/debian/libaprutil1.docs  1970-01-01 00:00:00.0 
+
@@ -1 +0,0 @@
-NOTICE
diff -Nru apr-util-1.6.3/debian/libaprutil1.install 
apr-util-1.6.3/debian/libaprutil1.install
--- apr-util-1.6.3/debian/libaprutil1.install   2023-02-01 21:35:51.0 
+
+++ apr-util-1.6.3/debian/libaprutil1.install   1970-01-01 00:00:00.0 
+
@@ -1,3 +0,0 @@
-usr/lib/*/libaprutil-1.so.*
-usr/lib/*/apr-util-1/apr_dbm*.so*
-usr/lib/*/apr-util-1/apr_crypt*.so*
diff -Nru apr-util-1.6.3/debian/libaprutil1.lintian-overrides 
apr-util-1.6.3/debian/libaprutil1.lintian-overrides
--- apr-util-1.6.3/debian/libaprutil1.lintian-overrides 2023-02-01 
21:35:51.0 +
+++ apr-util-1.6.3/debian/libaprutil1.lintian-overrides 1970-01-01 
00:00:00.0 +
@@ -1,2 +0,0 @@
-libaprutil1: symbols-declares-dependency-on-other-package
-libaprutil1: