please upgrade: lighttpd 1.4.76

Status changed to 'Confirmed' because the bug affects multiple users.

Hello, lighttpd 1.4.75 is not packages in Debian yet. Once packaged there it may (or may not!) come to Noble as a microrelease upgrade, see [1].

On your bug: please file a new bug stating the problem with mod_dirlisting and pointing to the fix. The fix may be delivered as a "normal" bugfix, cherry-picking the fix following the procedures described in [1].

[1] https://wiki.ubuntu.com/StableReleaseUpdates#New_upstream_microreleases

> Hello, lighttpd 1.4.75 is not packages in Debian yet.

I trust you are aware that all Debian development on all Debian 64-bit and 32-bit platforms is currently blocked due to the way Debian has (mis)"planned" the Debian time64 transition for 32-bit platforms.

Some Ubuntu developers are working with Debian developers and it seems that it was overlooked that the Ubuntu package stabilization for 24.04 beta overlapped with the Debian time64 transition.

I am a lighttpd developer.
lighttpd 1.4.75 is tagged https://salsa.debian.org/debian/lighttpd/
My Debian "Request for Sponsorship" for lighttpd package release is 3 weeks old.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067126

lighttpd 1.4.75 is intended for Ubuntu 24.04, which Ubuntu plans to maintain for 10 years. I hope that you will review the history of "how well" (lol) Ubuntu has "maintained" lighttpd and lighttpd patches in existing Ubuntu releases and understand why I am aiming for lighttpd 1.4.75 in Ubuntu 24.04.

https://redmine.lighttpd.net/projects/lighttpd/wiki/Release-1_4_76

https://salsa.debian.org/debian/lighttpd/ has a tag for debian/1.4.76-1

lighttpd (1.4.76-1) unstable; urgency=medium
  * New upstream version 1.4.76
  * Detect VU#421644 HTTP/2 CONTINUATION Flood
  * Avoid CVE-2024-3094 xz supply chain attack

I am a lighttpd developer and have prepared patches for Ubuntu updates/backports.

lighttpd 1.4.76 is the current stable lighttpd release and is the best available version of lighttpd.

Added in lighttpd 1.4.76:
  * Detect VU#421644 HTTP/2 CONTINUATION Flood
  * Avoid CVE-2024-3094 xz supply chain attack

Noble should upgrade lighttpd 1.4.74 to lighttpd 1.4.76

The Mantic Minotaur should upgrade lighttpd 1.4.69 to lighttpd 1.4.76 and needs a single patch for behavior compatibility to revert the upgrade to stronger TLS defaults. (revert lighttpd commit 87b3a9cab8d964330aef12db9f78aae66eaf0968) While I consider incremental improvement of secure defaults something that should be backported for best security practices, I understand that Ubuntu policy differs.
0001-Revert-TLS-default-to-stronger-ciphers-w-PFS-and-AEA.patch

The Jammy Jellyfish should upgrade lighttpd 1.4.63 to lighttpd 1.4.76 and needs a few patches for behavior compatibility -- again to downgrade stronger lighttpd TLS defaults to weaker defaults in lighttpd 1.4.63 -- and to restore deprecated TLS directives, and to restore deprecated modules.
0001-Revert-TLS-default-to-stronger-ciphers-w-PFS-and-AEA.patch
0002-Revert-TLS-simplify-TLS-config-remove-deprecated-opt.patch
0003-Revert-TLS-upgrade-default-cipher-list-to-stronger-s.patch
0004-Revert-multiple-remove-deprecated-modules.patch
0005-Revert-multiple-remove-long-deprecated-modules.patch

lighttpd 1.4.73 contains detection for HTTP/2 Rapid Reset attacks, which The Manic Minotaur and The Jammy Jellyfish ought to have in security and/or updates.

Requesting sponsorship and guidance from ubuntu-security-sponsors

Debian development is stalled and hideously broken on time64 transition for some 32-bit platforms, which has halted just about everything else in Debian unstable for all platforms, including 64-bit platforms.

debian/1.4.76-1 is tagged in https://salsa.debian.org/debian/lighttpd/, passes all autopkgtests, and is awaiting (eventual?) release in Debian unstable.

Please update Noble sooner, and advise on backporting to stable Ubuntu releases. Thank you.

I should note that CVE-2022-22707 is fixed in lighttpd 1.4.64, and The Jammy Jellyfish is running lighttpd 1.4.63.

It would also be nice if lighttpd 1.4.76 were made available in updates for The Focal Fossa and The Bionic Beaver, and even earlier Ubuntu releases if there are any still supported. (lighttpd 1.4.76 is able to run with older openssl and pcre libraries.)