pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2009Q2] pkgsrc/www/apache22
Module Name: pkgsrc
Committed By: spz
Date: Fri Aug 7 21:08:15 UTC 2009
Modified Files:
pkgsrc/www/apache22 [pkgsrc-2009Q2]: Makefile PLIST distinfo
pkgsrc/www/apache22/patches [pkgsrc-2009Q2]: patch-ba
Added Files:
pkgsrc/www/apache22/patches [pkgsrc-2009Q2]: patch-bb
Removed Files:
pkgsrc/www/apache22/patches [pkgsrc-2009Q2]: patch-ab patch-af patch-ah
patch-bc patch-bd
Log Message:
Pullup ticket 2852 - requested by tron
bug fix update
Revisions pulled up:
- pkgsrc/www/apache22/Makefile 1.48
- pkgsrc/www/apache22/PLIST 1.13
- pkgsrc/www/apache22/distinfo 1.23
- pkgsrc/www/apache22/patches/patch-ba 1.4
- pkgsrc/www/apache22/patches/patch-bb 1.3
Files added:
pkgsrc/www/apache22/patches/patch-bb
Files deleted:
pkgsrc/www/apache22/patches/patch-ab
pkgsrc/www/apache22/patches/patch-af
pkgsrc/www/apache22/patches/patch-ah
pkgsrc/www/apache22/patches/patch-bc
pkgsrc/www/apache22/patches/patch-bd
Module Name: pkgsrc
Committed By: tron
Date: Thu Aug 6 07:07:23 UTC 2009
Modified Files:
pkgsrc/www/apache22: Makefile PLIST distinfo
Removed Files:
pkgsrc/www/apache22/patches: patch-ab patch-af patch-ah patch-ba
patch-bc patch-bd
Log Message:
Update "apache22" package to version 2.2.12. Changes since version 2.2.11:
- SECURITY: CVE-2009-1891 (cve.mitre.org)
Fix a potential Denial-of-Service attack against mod_deflate or other
modules, by forcing the server to consume CPU time in compressing a
large file after a client disconnects. Bug 39605.
[Joe Orton, Ruediger Pluem]
- SECURITY: CVE-2009-1195 (cve.mitre.org)
Prevent the "Includes" Option from being enabled in an .htaccess
file if the AllowOverride restrictions do not permit it.
[Jonathan Peatfield <j.s.peatfield damtp.cam.ac.uk>, Joe Orton,
Ruediger Pluem, Jeff Trawick]
- SECURITY: CVE-2009-1890 (cve.mitre.org)
Fix a potential Denial-of-Service attack against mod_proxy in a
reverse proxy configuration, where a remote attacker can force a
proxy process to consume CPU time indefinitely. [Nick Kew, Joe Orton]
- SECURITY: CVE-2009-1191 (cve.mitre.org)
mod_proxy_ajp: Avoid delivering content from a previous request which
failed to send a request body. Bug 46949 [Ruediger Pluem]
- SECURITY: CVE-2009-0023, CVE-2009-1955, CVE-2009-1956 (cve.mitre.org)
The bundled copy of the APR-util library has been updated, fixing three
different security issues which may affect particular configurations
and third-party modules.
- mod_include: fix potential segfault when handling back references
on an empty SSI variable. [Ruediger Pluem, Lars Eilebrecht, Nick Kew]
- mod_alias: check sanity in Redirect arguments.
Bug 44729 [S??nke Tesch <st kino-fahrplan.de>, Jim Jagielski]
- mod_proxy_http: fix Host: header for literal IPv6 addresses.
Bug 47177 [Carlos Garcia Braschi <cgbraschi gmail.com>]
- mod_rewrite: Remove locking for writing to the rewritelog.
Bug 46942
- mod_alias: Ensure Redirect emits HTTP-compliant URLs.
Bug 44020
- mod_proxy_http: fix case sensitivity checking transfer encoding
Bug 47383 [Ryuzo Yamamoto <ryuzo.yamamoto gmail.com>]
- mod_rewrite: Fix the error string returned by RewriteRule.
RewriteRule returned "RewriteCond: bad flag delimiters" when the 3rd
argument of RewriteRule was not started with "[" or not ended with "]".
Bug 45082 [Vitaly Polonetsky <m_vitaly topixoft.com>]
- mod_proxy: Complete ProxyPassReverse to handle balancer URL's. Given;
BalancerMember balancer://alias http://example.com/foo
ProxyPassReverse /bash balancer://alias/bar
backend url http://example.com/foo/bar/that is now translated /bash/that
[William Rowe]
- New piped log syntax: Use "||process args" to launch the given process
without invoking the shell/command interpreter. Use "|$command line"
(the default behavior of "|command line" in 2.2) to invoke using shell,
consuming an additional shell process for the lifetime of the logging
pipe program but granting additional process invocation flexibility.
[William Rowe]
- mod_ssl: Add server name indication support (RFC 4366) and better
support for name based virtual hosts with SSL. Bug 34607
[Peter Sylvester <peter.sylvester edelweb.fr>,
Kaspar Brand <asfbugz velox.ch>, Guenter Knauf, Joe Orton,
Ruediger Pluem]
- mod_negotiation: Escape pathes of filenames in 406 responses to avoid
HTML injections and HTTP response splitting. Bug 46837.
[Geoff Keating <geoffk apple.com>]
- mod_include: Prevent a case of SSI timefmt-smashing with filter chains
including multiple INCLUDES filters. Bug 39369 [Joe Orton]
- mod_rewrite: When evaluating a proxy rule in directory context, do
escape the filename by default. Bug 46428 [Joe Orton]
- mod_proxy_ajp: Check more strictly that the backend follows the AJP
protocol. [Mladen Turk]
- mod_ssl: Add SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN directives
to enable stricter checking of remote server certificates.
[Ruediger Pluem]
- mod_substitute: Fix a memory leak. Bug 44948
[Dan Poirier <poirier pobox.com>]
- mod_proxy_ajp: Forward remote port information by default.
[Rainer Jung]
- mod_disk_cache/mod_mem_cache: Fix handling of CacheIgnoreHeaders
directive to correctly remove headers before storing them.
[Lars Eilebrecht]
- mod_deflate: revert changes in 2.2.8 that caused an invalid
etag to be emitted for on-the-fly gzip content-encoding.
Bug 39727 will require larger fixes and this fix was far more
harmful than the original code. Bug 45023. [Roy T. Fielding]
- mod_disk_cache: The module now turns off sendfile support if
'EnableSendfile off' is defined globally. Bug 41218.
[Lars Eilebrecht, Issac Goldstand]
- prefork: Fix child process hang during graceful restart/stop in
configurations with multiple listening sockets. Bug 42829. [Joe Orton,
Jeff Trawick]
- mod_ssl: Add SSLRenegBufferSize directive to allow changing the
size of the buffer used for the request-body where necessary
during a per-dir renegotiation. Bug 39243. [Joe Orton]
- mod_rewrite: Introduce DiscardPathInfo|DPI flag to stop the troublesome
way that per-directory rewrites append the previous notion of PATH_INFO
to each substitution before evaluating subsequent rules.
Bug 38642 [Eric Covener]
- mod_authnz_ldap: Reduce number of initialization debug messages and make
information more clear. Bug 46342 [Dan Poirier]
- mod_cache: Introduce 'no-cache' per-request environment variable
to prevent the saving of an otherwise cacheable response.
[Eric Covener]
- core: Translate the status line to ASCII on EBCDIC platforms in
ap_send_interim_response() and for locally generated "100 Continue"
responses. [Eric Covener]
- CGI: return 504 (Gateway timeout) rather than 500 when a script
times out before returning status line/headers.
Bug 42190 [Nick Kew]
- prefork: Log an error instead of segfaulting when child startup fails
due to pollset creation failures. Bug 46467. [Jeff Trawick]
- mod_ext_filter: fix error handling when the filter prog fails to start,
and introduce an onfail configuration option to abort
All the security problems mentioned above had already been fixed in
"pkgsrc" via patches. Thanks a lot to Adam Ciarcinski for letting me
know that new version had finally been released.
To generate a diff of this commit:
cvs rdiff -u -r1.47 -r1.48 pkgsrc/www/apache22/Makefile
cvs rdiff -u -r1.12 -r1.13 pkgsrc/www/apache22/PLIST
cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/apache22/distinfo
cvs rdiff -u -r1.10 -r0 pkgsrc/www/apache22/patches/patch-ab
cvs rdiff -u -r1.1 -r0 pkgsrc/www/apache22/patches/patch-af \
pkgsrc/www/apache22/patches/patch-ah
cvs rdiff -u -r1.2 -r0 pkgsrc/www/apache22/patches/patch-ba \
pkgsrc/www/apache22/patches/patch-bc pkgsrc/www/apache22/patches/patch-bd
-----
Module Name: pkgsrc
Committed By: tron
Date: Thu Aug 6 08:21:44 UTC 2009
Modified Files:
pkgsrc/www/apache22: distinfo
Added Files:
pkgsrc/www/apache22/patches: patch-ba patch-bb
Log Message:
Add patches provided by Adam Ciarcinski to fix build with recent versions
of OpenSSL (e.g. the version in NetBSD-current).
To generate a diff of this commit:
cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/apache22/distinfo
cvs rdiff -u -r0 -r1.4 pkgsrc/www/apache22/patches/patch-ba
cvs rdiff -u -r0 -r1.3 pkgsrc/www/apache22/patches/patch-bb
To generate a diff of this commit:
cvs rdiff -u -r1.46.2.1 -r1.46.2.2 pkgsrc/www/apache22/Makefile
cvs rdiff -u -r1.12 -r1.12.2.1 pkgsrc/www/apache22/PLIST
cvs rdiff -u -r1.20.2.1 -r1.20.2.2 pkgsrc/www/apache22/distinfo
cvs rdiff -u -r1.10 -r0 pkgsrc/www/apache22/patches/patch-ab
cvs rdiff -u -r1.1.2.2 -r0 pkgsrc/www/apache22/patches/patch-af \
pkgsrc/www/apache22/patches/patch-ah
cvs rdiff -u -r1.2 -r1.2.2.1 pkgsrc/www/apache22/patches/patch-ba
cvs rdiff -u -r0 -r1.3.2.2 pkgsrc/www/apache22/patches/patch-bb
cvs rdiff -u -r1.2 -r0 pkgsrc/www/apache22/patches/patch-bc \
pkgsrc/www/apache22/patches/patch-bd
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Home |
Main Index |
Thread Index |
Old Index