Fossil regression due CVE-2024-24795

[Leonidas S. Barbosa]

== SUMMARY ==
After CVE-2024-24795 reports were made that fossil stop to work properly
ref: https://bz.apache.org/bugzilla/show_bug.cgi?id=68905

== FIX ==
https://fossil-scm.org/home/info/f4ffefe708793b03

[Hans Joachim Desserud (hjd)]

FWIW it looks like Debian has handled this issue (see the attached bug watch).

[Ian Constantin (iconstantin)]

Workaround note:

Fossil CGI documentation adds config option to restore legacy behavior in Apache: https://fossil-scm.org/home/doc/trunk/www/server/any/cgi.md

[Ian Constantin (iconstantin)]

Fix commit: https://fossil-scm.org/home/info/a8e33fb161f45b65

(For this issue, a subset of the changes to src/http.c are the fix)

Followed by:

https://fossil-scm.org/home/info/71919ad1b542832c

and

https://fossil-scm.org/home/info/f4ffefe708793b03

[Launchpad Janitor (janitor)]

This bug was fixed in the package fossil - 1:2.22-1ubuntu0.1

---------------
fossil (1:2.22-1ubuntu0.1) mantic-security; urgency=medium

  * SECURITY REGRESSION: break due to apache2 security update (LP: #2064509)
    - debian/patches/missing-content-length-fix-*.patch: Update HTTP reply
      parser to deal with a missing Content-Length header.

 -- Ian Constantin <email address hidden> Wed, 08 May 2024 14:46:57 +0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package fossil - 1:2.18-1ubuntu0.1

---------------
fossil (1:2.18-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY REGRESSION: break due to apache2 security update (LP: #2064509)
    - debian/patches/missing-content-length-fix-*.patch: Update HTTP reply
      parser to deal with a missing Content-Length header.

 -- Ian Constantin <email address hidden> Wed, 08 May 2024 14:47:22 +0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package fossil - 1:2.10-1ubuntu0.1

---------------
fossil (1:2.10-1ubuntu0.1) focal-security; urgency=medium

  * SECURITY REGRESSION: break due to apache2 security update (LP: #2064509)
    - debian/patches/missing-content-length-fix-*.patch: Update HTTP reply
      parser to deal with a missing Content-Length header.

 -- Ian Constantin <email address hidden> Wed, 08 May 2024 14:47:38 +0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package fossil - 1:2.23-1ubuntu0.1

---------------
fossil (1:2.23-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY REGRESSION: break due to apache2 security update (LP: #2064509)
    - debian/patches/missing-content-length-fix-*.patch: Update HTTP reply
      parser to deal with a missing Content-Length header.

 -- Ian Constantin <email address hidden> Wed, 08 May 2024 14:48:59 +0300

[Ian Constantin (iconstantin)]

Xenial and Bionic also addressed through ESM:

Ubuntu 18.04 LTS
   fossil 1:2.5-1ubuntu0.1~

Ubuntu 16.04 LTS
   fossil 1:1.33-3ubuntu0.1~esm1

[Ian Constantin (iconstantin)]

USN for reference: https://ubuntu.com/security/notices/USN-6770-1