<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi,<div>updated in d/changelog.</div><div><br></div><div>Thanks!</div><div>Jan<br><div><br><blockquote type="cite"><div>On 11. 10. 2023, at 0:40, Thomas Ward <teward@thomas-ward.net> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<div style="line-break:after-white-space">
<div dir="auto">I will point out that patch doesnt *fix* the zero-day CVE. It simply adds additional mitigations that according to NGINX developers on nginx-devel are already suitably mitigated with the default config options for keepalive. Might as the Debian
security team's opinions on the claim this is actually a *fix* since it isnt...</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div id="composer_signature" dir="auto">
<div dir="auto" style="font-size:12px; color:#575757">Sent from my Galaxy</div>
</div>
<div dir="auto"><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>-------- Original message --------</div>
<div>From: Jan Mojzis <jan.mojzis@gmail.com> </div>
<div>Date: 10/10/23 18:36 (GMT-05:00) </div>
<div>To: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
</div>
<div>Cc: Thomas Ward <teward@thomas-ward.net>, Jérémy Lal <kapouer@melix.org> </div>
<div>Subject: nginx 1.24.0-2 </div>
<div><br>
</div>
<div>
<div style="line-break:after-white-space">Hi,
<div><br>
</div>
<div>I will upload a new version of nginx 1.24.0-2</div>
<div><br>
</div>
<div>Important changes:</div>
<div>- fix CVE-2023-44487 <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053770">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053770</a></div>
<div>- bugfix <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039905">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039905</a></div>
<div>- nginx-dev update:</div>
<div> - dh-sequence-nginx now detects <span style="">libnginx-mod-stream module and adds dependencies on </span><span style="">libnginx-mod-stream,</span></div>
<div><span style="">it allows better </span><font><span style="">usage dh-sequence-nginx and tries to fix libnginx-* modules transitions</span></font></div>
<div><br>
</div>
<div>full changelog:</div>
<div><a href="https://salsa.debian.org/nginx-team/nginx/-/blob/main/debian/changelog">https://salsa.debian.org/nginx-team/nginx/-/blob/main/debian/changelog</a></div>
<div><br>
</div>
<div><br>
</div>
<div>Jan</div>
</div>
</div>
</div>
</div></blockquote></div><br></div></body></html>