Please backport nginx 0.6.35 to Hardy, Intrepid from Jaunty Security

[Andres Rodriguez]

Please backport nginx 0.6.39 to Hardy, Intrepid and Jaunty. This new upstream release contains a SECURITY vulnerability detailed in CVE-2009-2629. For more information about this please see [1].

[1]: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/430064

[Andres Rodriguez (andreserl)]

Packages built can be found here: https://launchpad.net/~andreserl/+archive/ppa

[Andres Rodriguez (andreserl)]

Attaching Debdiffs between nginx_0.6.35-0ubuntu1 and nginx_0.6.39-0ubuntu1~jaunty1

[Andres Rodriguez (andreserl)]

Attaching debdiff between nginx_0.6.35-0ubuntu1 and nginx_0.6.39-0ubuntu1~intrepid1

[Andres Rodriguez (andreserl)]

Attaching debdiff between nginx_0.6.35-0ubuntu1 and nginx_0.6.39-0ubuntu1~hardy1

[Andres Rodriguez (andreserl)]

Just to clarify, I took jaunty package (nginx_0.6.35-0ubuntu1), and updated it to nginx_0.6.39-0ubuntu1 and created changelog entries (and changes where applicable) for each jaunty, intrepid, and hardy.

I uploaded the packages to my PPA, then installed them on VMs and test to install and run. They installed and run as supposed.

[Andres Rodriguez (andreserl)]

Attaching Hardy debdiff

[Andres Rodriguez (andreserl)]

Attaching Intrepid debdiff

[Andres Rodriguez (andreserl)]

Build logs can be found in my PPA: https://launchpad.net/~andreserl/+archive/ppa?field.series_filter=

It build/installs/runs. I've tested if packages install and runs in their respective VMs.

[Jonathan Riddell (jr)]

Why is this confirmed when nobody from the backports team has looked at it?

[John Dong (jdong)]

Hi Jonathan,

It is my oversight; The Confirmed state indicates that the backport has been verified by someone in the community to be appropriate. In Progress or Fix Committed should be set by a backports team member to indicate official blessing or sponsored upload for source-change backports, respectively.

In this case, I've reviewed the debdiffs and sponsored them, and should've set to Fix Committed for both the Hardy and Intrepid tasks.

I apologize for the confusion.

[Scott Kitterman (kitterman)]

Accepted Intrepid.

[Scott Kitterman (kitterman)]

Hardy accepted.