buildroot/package/apache, branch 2017.08

package/apache: bump version to 2.4.27

2017-07-11T19:31:17+00:00

Announcement: http://www.apache.org/dist/httpd/Announcement2.4.html Release notes: http://www.apache.org/dist/httpd/CHANGES_2.4.27 Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

apache: security bump to version 2.4.26

2017-06-20T21:24:33+00:00

Fixes the following security issues: CVE-2017-3167: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process. CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. While we're at it, use the upstream sha256 checksum instead of sha1. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

package/a*/Config.in: fix help text wrapping

2017-05-11T21:25:00+00:00

The check-package script when ran gives warnings on text wrapping on all of these Config files. This patch cleans up all warnings related to the text wrapping for the Config files starting with the letter a in the package directory. The appropriate indentation is: <2 spaces><62 chars> See http://nightly.buildroot.org/#writing-rules-config-in for more information. Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

package/a*/Config.in: fix ordering of statements

2017-04-29T15:17:02+00:00

The check-package script when ran gives warnings on ordering issues on all of these Config files. This patch cleans up all warnings related to the ordering in the Config files for packages starting with the letter a in the package directory. The appropriate ordering is: type, default, depends on, select, help See http://nightly.buildroot.org/#_config_files for more information. Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

package/apache: security bump version to 2.4.25

2016-12-22T09:01:22+00:00

Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.25 Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736, CVE-2016-8743. Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

apache: add customization of MPM

2016-09-12T21:13:44+00:00

MPM can be selected between event, prefork or worker Set worker as the default one as it was before even if event MPM is better on system supporting thread safe polling Signed-off-by: Fabrice Fontaine Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Thomas Petazzoni

package/apache: security bump to version 2.4.23

2016-07-07T09:48:49+00:00

Fixes CVE-2016-4979: TLS/SSL X.509 client certificate auth bypass with HTTP/2 http://httpd.apache.org/security/vulnerabilities_24.html Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

apache: bump to version 2.4.20

2016-04-13T19:36:43+00:00

Signed-off-by: Gustavo Zacarias Acked-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

apache, apr: fix atomic handling

2016-02-06T10:16:00+00:00

Since the apache package was introduced, --enable-nonportable-atomics=yes was passed when BR2_ARCH_HAS_ATOMICS. However, Apache doesn't take this option: it only passes it down when building the APR library. But since we're building APR separately, this statement had no effect. So this commit removes the useless code from the Apache package, and instead adds the appropriate logic to the apr package, using the new BR2_TOOLCHAIN_HAS_SYNC_x symbols rather than BR2_ARCH_HAS_ATOMICS. Signed-off-by: Thomas Petazzoni Acked-by: "Yann E. MORIN" Cc: Bernd Kuhls

package/apache: bump version to 2.4.18

2015-12-19T13:06:32+00:00

Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni