Ubuntu
lighttpd package

  1. Bug #1994989
  2. Comment #9

Comment 9 for bug 1994989

Revision history for this message
Jack Fewx (cseengineer) wrote :

Hello Paulo,

I am running the built 3.1 version (jammy, AMD64) and everything seems to be fine. I have not gone digging for an exploit to those CVEs to test out, so I'm going to trust the upstream developers and simplicity of fixes.

Thank you for the pointers on debdiff syntax, I replicated the effort on 2 new ones for you for Focal and Kinetic. Note the other 2 revisions only have 1 of the CVEs, Focal is only CVE-2022-22707, and Kinetic is only CVE-2022-41556. Too old and too new respectively for the other CVE.