diff options
| author | Andy Postnikov <apostnikov@gmail.com> | 2016-12-24 13:57:49 +0300 |
|---|---|---|
| committer | Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi> | 2017-03-06 14:06:47 +0200 |
| commit | 057227d51a20a463df7fecd1dc584c912969eda0 (patch) | |
| tree | 6f03597bee231c44355bd2d2c792fcd32fe91887 | |
| parent | fd6dfca5b840b3c1cfb074b81c587c27a386d7c3 (diff) | |
| download | aports-057227d51a20a463df7fecd1dc584c912969eda0.tar.bz2 aports-057227d51a20a463df7fecd1dc584c912969eda0.tar.xz | |
main/apache2: upgrade to 2.4.25
Security release http://www.apache.org/dist/httpd/CHANGES_2.4.25
Also it includes previous patch for httpoxy
fixes #6942
| -rw-r--r-- | main/apache2/APKBUILD | 35 | ||||
| -rw-r--r-- | main/apache2/CVE-2016-5387.patch | 17 |
2 files changed, 4 insertions, 48 deletions
diff --git a/main/apache2/APKBUILD b/main/apache2/APKBUILD index 0b56d0bdb3..b975bbc375 100644 --- a/main/apache2/APKBUILD +++ b/main/apache2/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=apache2 -pkgver=2.4.16 -pkgrel=1 +pkgver=2.4.25 +pkgrel=0 pkgdesc="A high performance Unix-based HTTP server" url="http://httpd.apache.org/" arch="all" @@ -28,7 +28,6 @@ source="http://archive.apache.org/dist/httpd/httpd-$pkgver.tar.bz2 proxy.conf lua.conf alpine.layout - CVE-2016-5387.patch " options="suid" @@ -220,32 +219,7 @@ _lua() { "$subpkgdir"/etc/apache2/conf.d/lua.conf || return 1 } - -md5sums="2b19cd338fd526dd5a63c57b1e9bfee2 httpd-2.4.16.tar.bz2 -e322b5211e49511cac6e40c86af1b1da apache2.confd -75fe4138b98fcffd01b8c8c077b944f3 apache2.logrotate -83c2ac51dbd0a68506902f9f6f4dfd24 apache2.initd -d99af87f64688e7e62703ca27fcfe3bd httpd.conf -5d0d024ca43571b863874ab871b2c109 ssl.conf -b70fe826486043e3953cfe21f9e6fa16 ldap.conf -fe26a0a70f572eb256a3c6c183a62223 proxy-html.conf -96eddccfca1ec0349f844e2460cf655b proxy.conf -449a4aea60473ac4a16f025fca4463e3 lua.conf -c66ff5f70260d5266e6803a59b39bd7f alpine.layout -61489c5f174756e63bae95c5d85d0e46 CVE-2016-5387.patch" -sha256sums="ac660b47aaa7887779a6430404dcb40c0b04f90ea69e7bd49a40552e9ff13743 httpd-2.4.16.tar.bz2 -8b0ce62fc4e7cea3801744969d0b2390e28e4d11dd533816eb91e9d7af225500 apache2.confd -dabf43e11c941125c771d2f4f5dadd1038906420716b747dfc8f5a946a0bdad5 apache2.logrotate -2ead4e8a26f3cffae1d7b52c7662ee3edfbcc573b01f87e96af127ee0c31a3e6 apache2.initd -758f7dca0070544697247e42338fc72511eb8927055fc66e8b1b39592b236e67 httpd.conf -5c97ba711b062427682c342e233bb81a8c1b62f714ca25143e856a47f3f0c031 ssl.conf -25771023d7c921a13c792607d47bd716c92698b20af21c018f0922eaf79a9604 ldap.conf -2511d6ea64c0f253b219670c445ed4f403f94caba5fb05e0b9600f0d107e1dda proxy-html.conf -00c42b7806eaa73e732be9d9e92c3e841b20c6d91a9920be47f19db8aee3513e proxy.conf -edf701795137566c7cf4b9c0c95ecd5f8c58269f5600217a0a4d289d2bf15384 lua.conf -cf0033a245d1d7752539613b6c92beaea9c0a755e7a877c8d41a2d4fd0f3eb22 alpine.layout -c38bf5061a7c8d2da010db57ecf36a8c29739d34a04f55c66405a2e9fc319cd8 CVE-2016-5387.patch" -sha512sums="039750ff962c08a7261896acc8272e59874d066f7d52721aaf967ddb737fc5716acc47e1effaf7c4d156ba61bc393e0738f64f8e89cc277ba2651e0f61d56628 httpd-2.4.16.tar.bz2 +sha512sums="6ba4ce1dcef71416cf1c0de2468c002767b5637a75744daf5beb0edd045749a751b3826c4132f594c48e4b33ca8e1b25ebfb63ac4c8b759ca066a89d3261fb22 httpd-2.4.25.tar.bz2 e0a0b87889eff01e8a1ee21853d26c0307ceb87428727e60819d29644d8e54e9bfc08c197924567bed26befc904f8384af19516aea849f3cd6859d76b175b742 apache2.confd 566a8c469ef148dfbb9449e91d6fb93baf85d06a31a52c283a7e402aef7bfa8b46c34ebed91c76b3e5a2cc606660145e8fc63fa41bdb22574c7efc4fc4d993e5 apache2.logrotate bb4056c9819996a41a920d53b01bd9fedcdb6227fde79d2bf7e81d96ce841c53fbd1a5550bc2d4fc3f88197ed71c4d2cc532056dfe603e32283fec9a5fc91385 apache2.initd @@ -255,5 +229,4 @@ fbdc28ea4b94af91640794945ac4e1f45e4200e54d5bdf64c0c03fc8bdb589e444cc4f7dd0b70b69 263149f4a0b515e3b6d162ff282ffa90f8a448c10eb7185aec0caf75af7691b5486fa74ebe4fd46ae0ccdcf226a227705b4be4c23ed12b6d0c0aedd94a348810 proxy-html.conf aabbe171219f15efe47f8e972fc1a43f98b48977aae91b597b65bb447027992bf81757bde68b26a67e5e3b9f2e748d94b3c85d5c07433627b6048d60a51d400b proxy.conf f2950005ac0d8c7a5e34958f1274c9ed0f5f634a5bc766e12834917937df9db901c5fc2460da70e1a62f17440d4719163cd4213496dbf579c80a789b8e18f65c lua.conf -30faedf3683e1600d9505dc593b0193359eed7e3d925da772ba795b1354171821233072293105d0da41376b2561823fa48c2406f07276648a87b858dcf323c5e alpine.layout -ebfcac5e4bc12a64d4d7e723d362cfc4912a6369ddd265a06dee95af1d5dbf8dd4bfe87ce227661afb386e19dc738e475e11aebd0ddcb5f827c14fe7c66d998c CVE-2016-5387.patch" +30faedf3683e1600d9505dc593b0193359eed7e3d925da772ba795b1354171821233072293105d0da41376b2561823fa48c2406f07276648a87b858dcf323c5e alpine.layout" diff --git a/main/apache2/CVE-2016-5387.patch b/main/apache2/CVE-2016-5387.patch deleted file mode 100644 index 494afef17c..0000000000 --- a/main/apache2/CVE-2016-5387.patch +++ /dev/null @@ -1,17 +0,0 @@ ---- a/server/util_script.c (revision 1752426) -+++ b/server/util_script.c (working copy) -@@ -186,6 +186,14 @@ AP_DECLARE(void) ap_add_common_vars(request_rec *r - else if (!strcasecmp(hdrs[i].key, "Content-length")) { - apr_table_addn(e, "CONTENT_LENGTH", hdrs[i].val); - } -+ /* HTTP_PROXY collides with a popular envvar used to configure -+ * proxies, don't let clients set/override it. But, if you must... -+ */ -+#ifndef SECURITY_HOLE_PASS_PROXY -+ else if (!strcasecmp(hdrs[i].key, "Proxy")) { -+ ; -+ } -+#endif - /* - * You really don't want to disable this check, since it leaves you - * wide open to CGIs stealing passwords and people viewing them |