summaryrefslogtreecommitdiffstats
path: root/package/apache
Commit message (Collapse)AuthorAgeFilesLines
* package/apache: bump version to 2.4.29Bernd Kuhls2017-10-242-3/+3
| | | | | | | Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.29 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/apache: bump to version 2.4.28Bernd Kuhls2017-10-063-33/+3
| | | | | | | | | Fix for CVE-2017-9798 is included in this release, so this patch is removed. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Update commit log: not a security bump] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* package/apache: add patch to fix CVE-2017-9798Bernd Kuhls2017-09-191-0/+30
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* package/apache: bump version to 2.4.27Bernd Kuhls2017-07-112-3/+3
| | | | | | | | Announcement: http://www.apache.org/dist/httpd/Announcement2.4.html Release notes: http://www.apache.org/dist/httpd/CHANGES_2.4.27 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* apache: security bump to version 2.4.26Peter Korsgaard2017-06-202-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-3167: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process. CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. While we're at it, use the upstream sha256 checksum instead of sha1. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/a*/Config.in: fix help text wrappingAdam Duskett2017-05-111-5/+6
| | | | | | | | | | | | | | The check-package script when ran gives warnings on text wrapping on all of these Config files. This patch cleans up all warnings related to the text wrapping for the Config files starting with the letter a in the package directory. The appropriate indentation is: <tab><2 spaces><62 chars> See http://nightly.buildroot.org/#writing-rules-config-in for more information. Signed-off-by: Adam Duskett <aduskett@codeblue.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/a*/Config.in: fix ordering of statementsAdam Duskett2017-04-291-2/+2
| | | | | | | | | | | | | The check-package script when ran gives warnings on ordering issues on all of these Config files. This patch cleans up all warnings related to the ordering in the Config files for packages starting with the letter a in the package directory. The appropriate ordering is: type, default, depends on, select, help See http://nightly.buildroot.org/#_config_files for more information. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/apache: security bump version to 2.4.25Bernd Kuhls2016-12-222-2/+2
| | | | | | | | | | | Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.25 Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736, CVE-2016-8743. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* apache: add customization of MPMFabrice Fontaine2016-09-122-1/+37
| | | | | | | | | | MPM can be selected between event, prefork or worker Set worker as the default one as it was before even if event MPM is better on system supporting thread safe polling Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com> Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/apache: security bump to version 2.4.23Bernd Kuhls2016-07-072-3/+3
| | | | | | | | | Fixes CVE-2016-4979: TLS/SSL X.509 client certificate auth bypass with HTTP/2 http://httpd.apache.org/security/vulnerabilities_24.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* apache: bump to version 2.4.20Gustavo Zacarias2016-04-132-3/+3
| | | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* apache, apr: fix atomic handlingThomas Petazzoni2016-02-061-4/+0
| | | | | | | | | | | | | | | | Since the apache package was introduced, --enable-nonportable-atomics=yes was passed when BR2_ARCH_HAS_ATOMICS. However, Apache doesn't take this option: it only passes it down when building the APR library. But since we're building APR separately, this statement had no effect. So this commit removes the useless code from the Apache package, and instead adds the appropriate logic to the apr package, using the new BR2_TOOLCHAIN_HAS_SYNC_x symbols rather than BR2_ARCH_HAS_ATOMICS. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
* package/apache: bump version to 2.4.18Bernd Kuhls2015-12-192-3/+3
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* apache: bump to version 2.4.17Vicente Olivert Riera2015-10-142-3/+3
| | | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/apache: security bump to version 2.4.16Bernd Kuhls2015-07-162-3/+3
| | | | | | | | Fixes CVE-2015-3183, CVE-2015-3185, CVE-2015-0253, CVE-2015-0228 http://marc.info/?l=apache-httpd-announce&m=143704705330655&w=2 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/apache: fix nios2 detectionBernd Kuhls2015-04-031-0/+18
| | | | | | | | | | | | | | | | | | | Apache treats nios2 as OS/2 which is wrong. Fixes http://autobuild.buildroot.net/results/27c/27c5848a344c7e16feefcbd3773b50a78d6e63f0/ http://autobuild.buildroot.net/results/d8c/d8cf103033c63e79ed2db0b600f120f6fcb5b5e9/ http://autobuild.buildroot.net/results/1de/1dec866cf9a5f731a9ed93dff5b8b98001863635/ http://autobuild.buildroot.net/results/776/776be8ef579e3444123d8183dca1062ece656436/ http://autobuild.buildroot.net/results/5d2/5d21ac2d8f008d984d6f8b359ebb0e2482545683/ http://autobuild.buildroot.net/results/87f/87f25b20f63eebf7f75e35064bad79e3d383e7a8/ http://autobuild.buildroot.net/results/1b7/1b75f52c70af7880d523185565b7aaf59d9f9b3e/ [Thomas: adjust patch so that it continues to match OS/2 properly, while still not matching NIOS2.] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* apache: new packageBernd Kuhls2015-02-224-0/+169
[Thomas: - Don't explicitly pass CC_FOR_BUILD and CFLAGS_FOR_BUILD, those are already part of the default environment passed by the autotools-package infrastructure. - Explicitly disable Lua and LuaJIT support to avoid mis-detection of host installation. - Explicitly handle the optional support of libxml2, OpenSSL and zlib. Especially, the absence of explicit handling for libxml2 was causing a build failure due to the host libxml2 being detected. - Remove /usr/manual and /usr/build from the target. This saves 20+ MB of target space.] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud