Format: 1.8 Date: Tue, 07 Jul 2020 09:46:50 +0200 Source: nginx Architecture: source Version: 1.18.0-4+ubuntu18.04.1+deb.sury.org+1 Distribution: bionic Urgency: high Maintainer: Debian Nginx Maintainers Changed-By: Ondřej Surý Closes: 851651 883104 897926 900790 911398 913090 913250 915728 929199 929200 935037 941917 948579 953025 963567 963860 Changes: nginx (1.18.0-4+ubuntu18.04.1+deb.sury.org+1) bionic; urgency=medium . * No-change backport to bionic . nginx (1.18.0-4) unstable; urgency=medium . * Revert: libnginx-mod-* now depends on nginx- (Closes: #963860). * Update ngx_http_auth_pam_module upstream URL. * libnginx-mod-* recommends nginx now. * http-auth-pam: Upgrade to 1.5.2 (Closes: #963567). * d/copyright: Bump year of http-auth-pam. . nginx (1.18.0-3) unstable; urgency=medium . * Source-only upload to allow migration. . nginx (1.18.0-2) unstable; urgency=medium . [ Ondřej Nový ] * d/copyright: - Update for upstream release - Add Thomas Ward from Ubuntu for debian/* * d/conf/sites-available/default: Update PHP path for PHP 7.4 * d/conf/nginx.conf: - Enable TLSv1.3 - Remove tcp_nodelay on, which is same as default - Remove keepalive_timeout 65 and use default value 75s. - Remove trailing whitespaces * Introduce nginx-core and make it new default for "nginx" * Add stream-geoip and stream-geoip2 modules * d/ngx-conf: Convert to Python 3 * d/control: Add GeoIP2 into description * Build dynamic modules only in extras flavour * libnginx-mod-* now depends on nginx- * Check if port 80 is free before starting during install . [ Ondřej Surý ] * http-geoip2: Add ngx_http_geoip2_module 3.3 . nginx (1.18.0-1) unstable; urgency=medium . [ Ondřej Nový ] * New upstream version 1.18.0 * Add REMOTE_USER fastcgi param * Use debhelper-compat instead of debian/compat * Replace dh_systemd_enable with dh_installsystemd * Set Rules-Requires-Root: no * d/rules/dh_installinit: Replace --no-restart-on-upgrade with --no-stop-on-upgrade * Bump debhelper compat level to 13 * Use package.maintscript instead of dpkg-maintscript-helper * Bump standards version to 4.5.0 * d/watch: Change to 1.18.x * d/patches/CVE-2019-20372.patch: Rebase * Convert d/ngxmod to Python 3 (Closes: #953025) * nchan: Upgrade to 1.2.7 * http-fancyindex: Upgrade to 0.4.4 * d/copyright: Add myself for Debian part * Add myself as uploader . [ Mohamed Akram ] * Enable --with-compat configure option (Closes: #897926) . nginx (1.16.1-3) unstable; urgency=high . * Handle CVE-2019-20372, error page request smuggling (Closes: #948579) . nginx (1.16.1-2) unstable; urgency=medium . * http-lua: Downgrade to 0.10.13 (Closes: #941917) Temporary fix FTBFS on architectures where Luajit is not available. . nginx (1.16.1-1) unstable; urgency=medium . * New upstream version (Closes: #929200) * Follow stable 1.16 releases (Closes: #929199) * Drop already included debian patches * http-ndk: Upgrade to 0.3.1 * http-lua: Upgrade to 0.10.15 . nginx (1.14.2-3) unstable; urgency=high . * Backport upstream fixes for 3 CVEs (Closes: #935037) Those fixes affect Nginx HTTP/2 implementation, which might cause excessive memory consumption and CPU usage. (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). . nginx (1.14.2-2) unstable; urgency=medium . [ Kartik Mistry ] * po/tr.po: + Added Turkish translation. Thanks Atila KOÇ (Closes: #915728) . [ Christos Trochalakis ] * http-dav-ext: Upgrade to 3.0.0 (Closes: #851651) * Use a minimal export of the upstream signing key * Bump Standards-Version, no changes needed . nginx (1.14.2-1) unstable; urgency=medium . [ Olaf van der Spek ] * Reference PHP 7.3 (Closes: 913250) . [ Christos Trochalakis ] * Adjust fastcgi_split_path_info snippet to handle the `/example.php/` case (Closes: #911398) . nginx (1.14.1-1) unstable; urgency=medium . [ Kartik Mistry ] * Removed unused lintian override. * Fixed trailing whitespaces in changelog. . [ Christos Trochalakis ] * New upstream version. (Closes: #913090) + CVE-2018-16843 Excessive memory usage in HTTP/2 + CVE-2018-16844 Excessive CPU usage in HTTP/2 + CVE-2018-16845 Memory disclosure in the ngx_http_mp4_module . nginx (1.14.0-1) unstable; urgency=medium . [ Kartik Mistry ] * debian/control: + Removed duplicate Build-Depends. + Use https in Homepage. . [ Christos Trochalakis ] * http-lua: Upgrade to 0.10.13 * http-lua: Drop our OpenSSL patch, OpenSSL 1.1 is now supported upstream * http-fancyindex: Upgrade to 0.4.3 * Order nginx after nss-lookup.target to synchronize host/network name lookups (Closes: #900790) * Merge ru translations. Thanks to Lev Lamberov (Closes: #883104) Checksums-Sha1: 8d65fd19e6d0fe92ee02ba84562f2bbdc2aabf0f 4868 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.dsc 47b2c5ccd12e2a7088b03d629ff6b9ab18215180 1039530 nginx_1.18.0.orig.tar.gz 86e722414405b0d1070f3c469c0446fe8964ca3a 1041016 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.debian.tar.xz 8249de1a88866d207d81e4f053d97b29ac9d82fb 11169 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1_source.buildinfo Checksums-Sha256: e861754e6767dba08b2e277a2d82714af52a66c19827f7e1e93275f60479dcbf 4868 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.dsc 4c373e7ab5bf91d34a4f11a0c9496561061ba5eee6020db272a17a7228d35f99 1039530 nginx_1.18.0.orig.tar.gz a399c2198be8023f04dd0e65e13d2b68726f4ed1940cbf94e070c314ed5eaa1b 1041016 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.debian.tar.xz a1aba27efe6a2491814e70e54edc1d9fe1d3aa6195447906ba5f26c2d7eba4f6 11169 nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1_source.buildinfo Files: 6ab2405ff793fc4ecaa54c475d02f201 4868 httpd optional nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.dsc b2d33d24d89b8b1f87ff5d251aa27eb8 1039530 httpd optional nginx_1.18.0.orig.tar.gz a50badf8c451bec394a73ff221663673 1041016 httpd optional nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1.debian.tar.xz 962f8efe9b95f2eb11863dc5f9bfb8d1 11169 httpd optional nginx_1.18.0-4+ubuntu18.04.1+deb.sury.org+1_source.buildinfo