libhttp-daemon-perl (6.17-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/perl-team/modules/packages/libhttp-daemon-perl.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 2760704
Browser: https://salsa.debian.org/perl-team/modules/packages/libhttp-daemon-perl
Last scan: 2026-08-10 04:38:01+00
Error: https://salsa.debian.org/api/v4/projects/perl-team%2Fmodules%2Fpackages%2Flibhttp-daemon-perl API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
Next scan: 2026-08-18 00:23:00+00

Debian changelog in Git:

libhttp-daemon-perl (6.17-1) unstable; urgency=medium

  * Import upstream version 6.17.
   - Fix CVE-2026-8450: 2-arg open() in send_file() enabled RCE / arbitrary
     file write / response-body exfiltration when a string argument was
     derived from attacker-influenced input. send_file() now uses 3-arg
     open() with an explicit '<' read mode, so the path is always treated as a
     literal filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
     '> path', etc.) are no longer interpreted.
   Closes: #1138050
  * Update years of upstream copyright.
  * Update Upstream-Contact in debian/copyright.
  * Declare compliance with Debian Policy 4.7.4.
  * Remove «Rules-Requires-Root: no», which is the current default.
  * Remove «Priority: optional», which is the current default.

 -- gregor herrmann <gregoa@debian.org>  Wed, 27 May 2026 19:23:34 +0200

This branch is even with tag debian/6.17-1