Your message dated Mon, 07 Mar 2005 23:17:15 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#298053: fixed in squid 2.5.9-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 4 Mar 2005 10:51:21 +0000
>From [EMAIL PROTECTED] Fri Mar 04 02:51:21 2005
Return-path: <[EMAIL PROTECTED]>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D7AOu-0002tV-00; Fri, 04 Mar 2005 02:51:21 -0800
Received: from dragon.kitenet.net (24-158-104-74.chartertn.net [24.158.104.74])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id 4219217FE7
for <[EMAIL PROTECTED]>; Fri, 4 Mar 2005 10:51:20 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id 4BFB66EEBE; Fri, 4 Mar 2005 05:53:54 -0500 (EST)
Date: Fri, 4 Mar 2005 05:53:54 -0500
From: Joey Hess <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: Race condition related to Set-Cookie header (CAN-2005-0626)
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="WIyZ46R2i8wDzkSu"
Content-Disposition: inline
X-Reportbug-Version: 3.8
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--WIyZ46R2i8wDzkSu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: squid
Version: 2.5.9-1
Severity: serious
Tags: patch
Please see
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-setcookie
A race window has been discovered where Set-Cookie headers may leak to an=
other
users if the requested server relies on the now (since 1997) obsolete Net=
scape
Set-Cookie specifications in how caches should handle the Set-Cookie head=
er on
otherwise cacheable content.
The patch does not seem to be applied in 2.5.9.
--=20
see shy jo
--WIyZ46R2i8wDzkSu
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCKD5Cd8HHehbQuO8RAn/OAJ9jjsAKz54n3o9XfFy3mEp4RaCpwQCgl7//
P/+GmjpbJBxOSNc9YCmaA7E=
=EYcd
-----END PGP SIGNATURE-----
--WIyZ46R2i8wDzkSu--
---------------------------------------
Received: (at 298053-close) by bugs.debian.org; 8 Mar 2005 04:23:09 +0000
>From [EMAIL PROTECTED] Mon Mar 07 20:23:09 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D8WFR-00014T-00; Mon, 07 Mar 2005 20:23:09 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D8W9j-0000Rn-00; Mon, 07 Mar 2005 23:17:15 -0500
From: Luigi Gangitano <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#298053: fixed in squid 2.5.9-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 07 Mar 2005 23:17:15 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: squid
Source-Version: 2.5.9-2
We believe that the bug you reported is fixed in the latest version of
squid, which is due to be installed in the Debian FTP archive:
squid-cgi_2.5.9-2_i386.deb
to pool/main/s/squid/squid-cgi_2.5.9-2_i386.deb
squid-common_2.5.9-2_all.deb
to pool/main/s/squid/squid-common_2.5.9-2_all.deb
squid_2.5.9-2.diff.gz
to pool/main/s/squid/squid_2.5.9-2.diff.gz
squid_2.5.9-2.dsc
to pool/main/s/squid/squid_2.5.9-2.dsc
squid_2.5.9-2_i386.deb
to pool/main/s/squid/squid_2.5.9-2_i386.deb
squidclient_2.5.9-2_i386.deb
to pool/main/s/squid/squidclient_2.5.9-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Luigi Gangitano <[EMAIL PROTECTED]> (supplier of updated squid package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 8 Mar 2005 04:37:22 +0100
Source: squid
Binary: squid squid-cgi squidclient squid-common
Architecture: source i386 all
Version: 2.5.9-2
Distribution: unstable
Urgency: medium
Maintainer: Luigi Gangitano <[EMAIL PROTECTED]>
Changed-By: Luigi Gangitano <[EMAIL PROTECTED]>
Description:
squid - Internet Object Cache (WWW proxy cache)
squid-cgi - Squid cache manager CGI program
squid-common - Internet Object Cache (WWW proxy cache) - common file
squidclient - Command line URL extractor that talks to (a) squid
Closes: 298053
Changes:
squid (2.5.9-2) unstable; urgency=medium
.
* Urgency medium due to small security fix
.
* debian/patches/37-setcookie.dpatch
- Added upstream patchto fix race condition with Set-Cookie headers
(Closes: #298053)
.
* debian/watch
- Re-Updated watch file, this should really work
Files:
790f7a94be85a0e0a9f96460327d0773 645 web optional squid_2.5.9-2.dsc
805533b7e3f02d4c5a7bd90136a6d49d 296376 web optional squid_2.5.9-2.diff.gz
c934ab036ffb972313f1fae41ee4bab4 194464 web optional
squid-common_2.5.9-2_all.deb
653d180cff2913b1a93f8684d66636cc 761216 web optional squid_2.5.9-2_i386.deb
f1751db2cb536b02a9cdd2ce2e2d2952 74388 web optional
squidclient_2.5.9-2_i386.deb
966abd6e4ecaa642f544e5b408bff200 92246 web optional squid-cgi_2.5.9-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCLSL+8ZumGJJMDCYRAiWWAKCGS4ECsQCaTcdUs04N7+EwSagvMgCfebKn
wg8KOndAepPMs6oZ9LQqr8w=
=GG0d
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
