CVS commit: pkgsrc/www/apache24

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/www/apache24
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Fri, 20 Jan 2023 14:03:16 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Jan 20 14:03:16 UTC 2023

Modified Files:
        pkgsrc/www/apache24: Makefile PLIST distinfo
        pkgsrc/www/apache24/patches: patch-configure

Log Message:
apache24: updated to 2.4.55

Changes with Apache 2.4.55

  *) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
     2.4.55 allows a backend to trigger HTTP response splitting
     (cve.mitre.org)
     Prior to Apache HTTP Server 2.4.55, a malicious backend can
     cause the response headers to be truncated early, resulting in
     some headers being incorporated into the response body. If the
     later headers have any security purpose, they will not be
     interpreted by the client.
     Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)

  *) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
     Possible request smuggling (cve.mitre.org)
     Inconsistent Interpretation of HTTP Requests ('HTTP Request
     Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
     allows an attacker to smuggle requests to the AJP server it
     forwards requests to.  This issue affects Apache HTTP Server
     Apache HTTP Server 2.4 version 2.4.54 and prior versions.
     Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
     at Qi'anxin Group

  *) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
     of zero byte (cve.mitre.org)
     A carefully crafted If: request header can cause a memory read,
     or write of a single zero byte, in a pool (heap) memory location
     beyond the header value sent. This could cause the process to
     crash.
     This issue affects Apache HTTP Server 2.4.54 and earlier.

  *) mod_dav: Open the lock database read-only when possible.

  *) mod_proxy_http2: apply the standard httpd content type handling
     to responses from the backend, as other proxy modules do.

  *) mod_dav: mod_dav overrides dav_fs response on PUT failure.

  *) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]

  *) mod_http2: version 2.0.10 of the module, synchronizing changes
     with the gitgub version. This is a partial rewrite of how connections
     and streams are handled.
     - an APR pollset and pipes (where supported) are used to monitor
       the main connection and react to IO for request/response handling.
       This replaces the stuttered timed waits of earlier versions.
     - H2SerializeHeaders directive still exists, but has no longer an effect.
     - Clients that seemingly misbehave still get less resources allocated,
       but ongoing requests are no longer disrupted.
     - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
       were overwritten instead of preserved.
     - A regression in v1.15.24 was fixed that could lead to httpd child
       processes not being terminated on a graceful reload or when reaching
       MaxConnectionsPerChild. When unprocessed h2 requests were queued at
       the time, these could stall.
     - Improved information displayed in 'server-status' for H2 connections when
       Extended Status is enabled. Now one can see the last request that IO
       operations happened on and transferred IO stats are updated as well.
     - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
       send a GOAWAY frame much too early on new connections, leading to invalid
       protocol state and a client failing the request.
       The module now initializes the HTTP/2 protocol correctly and allows the
       client to submit one request before the shutdown via a GOAWAY frame
       is being announced.
     - :scheme pseudo-header values, not matching the
       connection scheme, are forwarded via absolute uris to the
       http protocol processing to preserve semantics of the request.
       Checks on combinations of pseudo-headers values/absence
       have been added as described in RFC 7540. Fixes #230.
     - A bug that prevented trailers (e.g. HEADER frame at the end) to be
       generated in certain cases was fixed. See #233 where it prevented
       gRPC responses to be properly generated.
     - Request and response header values are automatically stripped of leading
       and trialing space/tab characters. This is equivalent behaviour to what
       Apache httpd's http/1.1 parser does.
       The checks for this in nghttp2 v1.50.0+ are disabled.
     - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
       on the v2.0.x versions for stability. Many thanks!
  *) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
     request ':authority' is known. Improved test case that did not catch that
     the previous 'fix' was incorrect.

  *) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
     using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]

  *) mod_proxy: The AH03408 warning for a forcibly closed backend
     connection is now logged at INFO level.  [Yann Ylavic]

  *) mod_ssl: When dumping the configuration, the existence of
     certificate/key files is no longer tested.  [Joe Orton]

  *) mod_authn_core: Add expression support to AuthName and AuthType.
     [Graham Leggett]

  *) mod_ssl: when a proxy connection had handled a request using SSL, an
     error was logged when "SSLProxyEngine" was only configured in the
     location/proxy section and not the overall server. The connection
     continued to work, the error log was in error.

  *) mod_proxy_hcheck: Re-enable workers in standard ERROR state.

  *) mod_proxy_hcheck: Detect AJP/CPING support correctly.

  *) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]

  *) mod_md: a new directive `MDStoreLocks` can be used on cluster
     setups with a shared file system for `MDStoreDir` to order
     activation of renewed certificates when several cluster nodes are
     restarted at the same time. Store locks are not enabled by default.
     Restored curl_easy cleanup behaviour from v2.4.14 and refactored
     the use of curl_multi for OCSP requests to work with that.
     Fixes <https://github.com/icing/mod_md/issues/293>.

  *) core: Avoid an overflow on large inputs in ap_is_matchexp.

  *) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
     storage instead of slotmem. Needed after setting
     HeartbeatMaxServers default to the documented value 10 in 2.4.54.

  *) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
     This is a game changer for performances if client use PROPFIND a lot.


To generate a diff of this commit:
cvs rdiff -u -r1.114 -r1.115 pkgsrc/www/apache24/Makefile
cvs rdiff -u -r1.35 -r1.36 pkgsrc/www/apache24/PLIST
cvs rdiff -u -r1.53 -r1.54 pkgsrc/www/apache24/distinfo
cvs rdiff -u -r1.2 -r1.3 pkgsrc/www/apache24/patches/patch-configure

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/apache24/Makefile
diff -u pkgsrc/www/apache24/Makefile:1.114 pkgsrc/www/apache24/Makefile:1.115
--- pkgsrc/www/apache24/Makefile:1.114  Wed Nov 23 16:21:18 2022
+++ pkgsrc/www/apache24/Makefile        Fri Jan 20 14:03:16 2023
@@ -1,13 +1,12 @@
-# $NetBSD: Makefile,v 1.114 2022/11/23 16:21:18 adam Exp $
+# $NetBSD: Makefile,v 1.115 2023/01/20 14:03:16 adam Exp $
 #
 # When updating this package, make sure that no strings like
 # "PR 12345" are in the commit message. Upstream likes
 # to reference their own PRs this way, but this ends up
 # in NetBSD GNATS.
 
-DISTNAME=      httpd-2.4.54
+DISTNAME=      httpd-2.4.55
 PKGNAME=       ${DISTNAME:S/httpd/apache/}
-PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_APACHE:=httpd/}
 MASTER_SITES+= https://archive.apache.org/dist/httpd/

Index: pkgsrc/www/apache24/PLIST
diff -u pkgsrc/www/apache24/PLIST:1.35 pkgsrc/www/apache24/PLIST:1.36
--- pkgsrc/www/apache24/PLIST:1.35      Tue Dec 21 09:18:37 2021
+++ pkgsrc/www/apache24/PLIST   Fri Jan 20 14:03:16 2023
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.35 2021/12/21 09:18:37 adam Exp $
+@comment $NetBSD: PLIST,v 1.36 2023/01/20 14:03:16 adam Exp $
 bin/ab
 bin/apxs
 bin/dbmmanage
@@ -42,6 +42,7 @@ include/httpd/mod_cgi.h
 include/httpd/mod_core.h
 include/httpd/mod_dav.h
 include/httpd/mod_dbd.h
+include/httpd/mod_http2.h
 include/httpd/mod_include.h
 include/httpd/mod_log_config.h
 include/httpd/mod_proxy.h

Index: pkgsrc/www/apache24/distinfo
diff -u pkgsrc/www/apache24/distinfo:1.53 pkgsrc/www/apache24/distinfo:1.54
--- pkgsrc/www/apache24/distinfo:1.53   Thu Jun  9 18:15:50 2022
+++ pkgsrc/www/apache24/distinfo        Fri Jan 20 14:03:16 2023
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.53 2022/06/09 18:15:50 adam Exp $
+$NetBSD: distinfo,v 1.54 2023/01/20 14:03:16 adam Exp $
 
-BLAKE2s (httpd-2.4.54.tar.bz2) = 421718830ac12956e4d25911309314eefa3be169462008243d93b5106f226ab1
-SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18
-Size (httpd-2.4.54.tar.bz2) = 7434530 bytes
+BLAKE2s (httpd-2.4.55.tar.bz2) = e822cdaece492e04d2b4bd5761ae64ab2d26def4a7f534e2977991ec8cfb995f
+SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb
+Size (httpd-2.4.55.tar.bz2) = 7456187 bytes
 SHA1 (patch-aa) = 9a66685f1d2e4710ab464beda98cbaad632aebf9
 SHA1 (patch-ab) = a3edcc20b7654e0446c7d442cda1510b23e5d324
 SHA1 (patch-ad) = 4ba4a9c812951f533fa316e5dbf17eaab5494157
@@ -12,6 +12,6 @@ SHA1 (patch-ai) = d3870e46e41adc97c3fce8
 SHA1 (patch-al) = 02d9ade5aac4270182063d5ad413970c832ee911
 SHA1 (patch-am) = acdf7198ae8b4353cfc70c8015a0f09de036b777
 SHA1 (patch-aw) = 43cd64df886853ef7b75b91ed20183f329fcc9df
-SHA1 (patch-configure) = 7426d8b053cfe89c5e37b0a4591f2eba2a8ca17f
+SHA1 (patch-configure) = 050119b817b53d72909be1906181434bf18fe3d7
 SHA1 (patch-include_ap__config.h) = 1d056e2d4db80ec97aaf755b6dd6aff69ed2cd96
 SHA1 (patch-modules_filters_mod_substitute.c) = 730af0342b78de04fe51b7dcc3ed057b2b0c3a54

Index: pkgsrc/www/apache24/patches/patch-configure
diff -u pkgsrc/www/apache24/patches/patch-configure:1.2 pkgsrc/www/apache24/patches/patch-configure:1.3
--- pkgsrc/www/apache24/patches/patch-configure:1.2     Tue Mar 15 05:46:54 2022
+++ pkgsrc/www/apache24/patches/patch-configure Fri Jan 20 14:03:16 2023
@@ -1,9 +1,9 @@
-$NetBSD: patch-configure,v 1.2 2022/03/15 05:46:54 adam Exp $
+$NetBSD: patch-configure,v 1.3 2023/01/20 14:03:16 adam Exp $
 
---- configure.orig     2022-03-09 14:17:37.000000000 +0000
+--- configure.orig     2023-01-10 13:38:25.000000000 +0000
 +++ configure
-@@ -41155,7 +41155,6 @@ cat >>confdefs.h <<_ACEOF
- _ACEOF
+@@ -42087,7 +42087,6 @@ printf "%s\n" "#define SERVER_CONFIG_FIL
+ printf "%s\n" "#define AP_TYPES_CONFIG_FILE \"${rel_sysconfdir}/mime.types\"" >>confdefs.h
  
  
 -perlbin=`$ac_aux_dir/PrintPath perl`

Prev by Date: CVS commit: pkgsrc/math/py-numpy
Next by Date: CVS commit: pkgsrc/devel/py-cpplint
Previous by Thread: CVS commit: pkgsrc/math/py-numpy
Next by Thread: CVS commit: pkgsrc/devel/py-cpplint
Indexes:

Home | Main Index | Thread Index | Old Index