Re: Update of debian-archive-keyring in stretch?

2021-10-05 Thread Jonathan Wiltshire
Hi, On Sat, Oct 02, 2021 at 09:35:56PM +0530, Utkarsh Gupta wrote: > Hi Jonathan, > > On Wed, Aug 25, 2021 at 11:27 PM Raphael Hertzog wrote: > > it would be nice if we could get an update of debian-archive-keyring > > in stretch to add the bullseye key just like it has been done in buster a > >

Re: libapache2-mod-proxy-uwsgi 2.0.14+20161117-3+deb9u4 - duplicated request path

2021-10-05 Thread Moritz Mühlenhoff
reassign 995368 uwsgi thanks Am Fri, Oct 01, 2021 at 04:16:05PM +0200 schrieb Josef Kejzlar, wpj s.r.o.: > I can confirm this regression. > After unattended security upgrades got applied during the night, all > our applications stopped working. > > There is wrong request path sent to uwsgi server

Re: libapache2-mod-proxy-uwsgi 2.0.14+20161117-3+deb9u4 - duplicated request path

2021-10-05 Thread Sylvain Beucler
Thank you Moritz for forwarding the bug report. Josef, Philippe, can you provide further information, such as Apache configuration excerpts, and details about your apache/uwsgi setup? I did not experience issues with my tests using a simple Django application (cf. https://wiki.debian.org/LTS/

Re: libapache2-mod-proxy-uwsgi 2.0.14+20161117-3+deb9u4 - duplicated request path

2021-10-05 Thread Philippe Accorsi
Hi, I work on this project https://github.com/tracim/tracim and we saw the problem with the docker images created with files available here https://github.com/tracim/tracim/tree/develop/tools_docker/Debian_Uwsgi/ . We create docker images on Debian Stretch and install package libapache2-mod-

Re: libapache2-mod-proxy-uwsgi 2.0.14+20161117-3+deb9u4 - duplicated request path

2021-10-05 Thread Sylvain Beucler
affects 995368 apache2 thanks @Philippe thank you for the detailed info. @Moritz bookworm/apache2-2.4.49's behavior currently matches uwsgi/stretch's (buggy) behavior, it looks like the upstream patch introduced a regression. (This 2.4.49 release appears to have been tested poorly upstream, th

Re: libapache2-mod-proxy-uwsgi - CVE-2021-36160 regression, altered PATH_INFO

2021-10-05 Thread Sylvain Beucler
tags 995368 + upstream forwarded 995368 https://bz.apache.org/bugzilla/show_bug.cgi?id=65616 thanks Note: there doesn't seem to be actual path duplication at the UWSGI level, AFAICS Django just gets confused by the additional '/' at the start of PATH_INFO and incorrectly duplicates the path in