[pkgsrc/trunk]: pkgsrc/www/nghttp2 nghttp2: updated to 1.39.2

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/94b98429814d
branches:  trunk
changeset: 337876:94b98429814d
user:      adam <adam%pkgsrc.org@localhost>
date:      Wed Aug 14 07:43:33 2019 +0000

description:
nghttp2: updated to 1.39.2

nghttp2 v1.39.2

This release fixes CVE-2019-9511 ?Data Dribble? and CVE-2019-9513
?Resource Loop? vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
frames cause Denial of Service by consuming CPU time. Check out
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for details. For nghttpx, additionally limiting inbound traffic by --read-rate and --read-burst options is quite effective against this kind of attack.

Fix CVE-2019-9511 and CVE-2019-9513
Add nghttp2_option_set_max_outbound_ack API function
nghttpx: Fix request stall

diffstat:

 www/nghttp2/Makefile |   5 ++---
 www/nghttp2/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 8 deletions(-)

diffs (28 lines):

diff -r 7620ea964877 -r 94b98429814d www/nghttp2/Makefile
--- a/www/nghttp2/Makefile      Wed Aug 14 07:17:01 2019 +0000
+++ b/www/nghttp2/Makefile      Wed Aug 14 07:43:33 2019 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.54 2019/07/01 04:07:53 ryoon Exp $
+# $NetBSD: Makefile,v 1.55 2019/08/14 07:43:33 adam Exp $
 
-DISTNAME=      nghttp2-1.39.1
-PKGREVISION=   1
+DISTNAME=      nghttp2-1.39.2
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=tatsuhiro-t/}
 EXTRACT_SUFX=  .tar.xz
diff -r 7620ea964877 -r 94b98429814d www/nghttp2/distinfo
--- a/www/nghttp2/distinfo      Wed Aug 14 07:17:01 2019 +0000
+++ b/www/nghttp2/distinfo      Wed Aug 14 07:43:33 2019 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.41 2019/06/13 09:28:52 adam Exp $
+$NetBSD: distinfo,v 1.42 2019/08/14 07:43:33 adam Exp $
 
-SHA1 (nghttp2-1.39.1.tar.xz) = 7f2390d1de857212f684e015540a9213372add7b
-RMD160 (nghttp2-1.39.1.tar.xz) = 05226b15b1e860793b4d638bdcccba51f4eddfc9
-SHA512 (nghttp2-1.39.1.tar.xz) = 36558ed03c59086086abbf144ec7c54c60de3fea00a9ea594feea7186a779781cbb66a08c9b34265892dea382b42b875f551e85331cfa0086e357f9b27b919fa
-Size (nghttp2-1.39.1.tar.xz) = 1634512 bytes
+SHA1 (nghttp2-1.39.2.tar.xz) = 21cc8e8b1f71e3812c5c957280d6addd916311fa
+RMD160 (nghttp2-1.39.2.tar.xz) = 5bda6a53aeaa2d7c194c990346951080a96f0912
+SHA512 (nghttp2-1.39.2.tar.xz) = d8c971543e3e87736dfafebca55e9ecd0644e304c9731edaccba34170205824476595861a439077289b438ad489dd6008dedf2c6b2c111920300329be1b1bf34
+Size (nghttp2-1.39.2.tar.xz) = 1635428 bytes