buildroot/package/apache, branch 2018.02

package/apache: bump version to 2.4.29

2017-10-24T06:00:12+00:00

Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.29 Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

package/apache: bump to version 2.4.28

2017-10-06T16:41:57+00:00

Fix for CVE-2017-9798 is included in this release, so this patch is removed. Signed-off-by: Bernd Kuhls [Update commit log: not a security bump] Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

package/apache: add patch to fix CVE-2017-9798

2017-09-19T19:44:28+00:00

Signed-off-by: Bernd Kuhls Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

package/apache: bump version to 2.4.27

2017-07-11T19:31:17+00:00

Announcement: http://www.apache.org/dist/httpd/Announcement2.4.html Release notes: http://www.apache.org/dist/httpd/CHANGES_2.4.27 Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

apache: security bump to version 2.4.26

2017-06-20T21:24:33+00:00

Fixes the following security issues: CVE-2017-3167: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process. CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. While we're at it, use the upstream sha256 checksum instead of sha1. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

package/a*/Config.in: fix help text wrapping

2017-05-11T21:25:00+00:00

The check-package script when ran gives warnings on text wrapping on all of these Config files. This patch cleans up all warnings related to the text wrapping for the Config files starting with the letter a in the package directory. The appropriate indentation is: <2 spaces><62 chars> See http://nightly.buildroot.org/#writing-rules-config-in for more information. Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

package/a*/Config.in: fix ordering of statements

2017-04-29T15:17:02+00:00

The check-package script when ran gives warnings on ordering issues on all of these Config files. This patch cleans up all warnings related to the ordering in the Config files for packages starting with the letter a in the package directory. The appropriate ordering is: type, default, depends on, select, help See http://nightly.buildroot.org/#_config_files for more information. Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

package/apache: security bump version to 2.4.25

2016-12-22T09:01:22+00:00

Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.25 Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736, CVE-2016-8743. Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

apache: add customization of MPM

2016-09-12T21:13:44+00:00

MPM can be selected between event, prefork or worker Set worker as the default one as it was before even if event MPM is better on system supporting thread safe polling Signed-off-by: Fabrice Fontaine Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Thomas Petazzoni

package/apache: security bump to version 2.4.23

2016-07-07T09:48:49+00:00

Fixes CVE-2016-4979: TLS/SSL X.509 client certificate auth bypass with HTTP/2 http://httpd.apache.org/security/vulnerabilities_24.html Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni