Commit Message
For details see:
https://dlcdn.apache.org/httpd/CHANGES_2.4.71
"Changes with Apache 2.4.71
*) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in
assign_headers (cve.mitre.org)
Concurrent Execution using Shared Resource with Improper
Synchronization vulnerability in Apache HTTP Server's mod_http2
in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through
2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through
2.0.42.
Credits: Anthropic's OSS Scanner, as vulnerability
ANT-2026-MAPKT6MZ
*) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer
overwrite (after CVE-2026-63292) (cve.mitre.org)
Stack-based buffer overflow vulnerability in Apache HTTP
Server's mod_vhost_alias (after CVE-2026-63292)
This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.
Credits: Gustavo Aiello
*) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads
to child process crash (cve.mitre.org)
NULL pointer dereference vulnerability in Apache HTTP Server's
mod_md during HTTP request processing.
This issue affects Apache HTTP Server: from 2.4.30 through
2.4.70.
Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability
Research Institute, working with 360 TuLongFeng.
*) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain.
New directive MDHttpProxyCACertificateFile sets the CA certificates
used to verify an HTTPS proxy.
[Michael Kaufmann <mail michael-kaufmann.ch>]
*) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a
length byte with the high bit set is no longer sign-extended, fixing
inflation of gzip streams that carry an extra field.
[arshiya tabasum <arshi bugqore.com>]
*) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host
they are configured in, and merge the proxy entries of the main server
and of the virtual host, logging a warning when both have some.
PR 70207. [Arturo Bernal]
*) mod_dav: Fix handling of invalid or overflowing "Timeout:"
request headers, which could silently grant a lock with an
already-expired timeout instead of the RFC 4918 maximum.
PR 65788 [Arturo Bernal]
*) mod_http2: Correctly handle the asterisk-form of OPTIONS requests
instead of rejecting them as malformed. PR 70195.
[Arturo Bernal <abernal apache.org>]
*) mod_http2: Fix duplicate logging of header limit violations.
[Michael Kaufmann <mail michael-kaufmann.ch>]
*) mod_http2: Fix a crash creating an HTTP/2 session with
"H2PushDiarySize 0" and debug logging enabled. [Joe Orton]
*) mod_dav_lock: Fix dav_generic_load_lock_record() reading the
indirect-lock key length with the wrong width, which could read
back a wrong length on big-endian platforms. PR 70299
[Arturo Bernal]
*) mod_remoteip: Log a connection closed before a complete PROXY protocol
header was received at info level rather than as an error. PR 63893.
[Joe Orton]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
config/rootfiles/common/apache2 | 9 +++++++++
lfs/apache2 | 4 ++--
2 files changed, 11 insertions(+), 2 deletions(-)
@@ -498,6 +498,7 @@ srv/web/ipfire/html/captive
#srv/web/ipfire/manual/howto/ssi.html.ja.utf8
#srv/web/ipfire/manual/howto/ssi.html.ko.euc-kr
#srv/web/ipfire/manual/images
+#srv/web/ipfire/manual/images/README.md
#srv/web/ipfire/manual/images/apache_header.gif
#srv/web/ipfire/manual/images/bal-man-b.png
#srv/web/ipfire/manual/images/bal-man-w.png
@@ -534,8 +535,16 @@ srv/web/ipfire/html/captive
#srv/web/ipfire/manual/images/reverse-proxy-arch.png
#srv/web/ipfire/manual/images/rewrite_backreferences.png
#srv/web/ipfire/manual/images/rewrite_backreferences.svg
+#srv/web/ipfire/manual/images/rewrite_l_flag_looping.png
+#srv/web/ipfire/manual/images/rewrite_l_flag_looping.svg
+#srv/web/ipfire/manual/images/rewrite_module_order.png
+#srv/web/ipfire/manual/images/rewrite_module_order.svg
+#srv/web/ipfire/manual/images/rewrite_path_stripping.png
+#srv/web/ipfire/manual/images/rewrite_path_stripping.svg
#srv/web/ipfire/manual/images/rewrite_process_uri.png
#srv/web/ipfire/manual/images/rewrite_process_uri.svg
+#srv/web/ipfire/manual/images/rewrite_simplified_overview.png
+#srv/web/ipfire/manual/images/rewrite_simplified_overview.svg
#srv/web/ipfire/manual/images/right.gif
#srv/web/ipfire/manual/images/ssl_intro_fig1.gif
#srv/web/ipfire/manual/images/ssl_intro_fig1.png
@@ -25,7 +25,7 @@
include Config
-VER = 2.4.68
+VER = 2.4.71
THISAPP = httpd-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5c2d4b21915db3ca62ee374e89bb04dcec21a6f2f1334f6306db079de03a974709ef71f3728c56e020c844e331b800306fcf5a865dcd2e02576d41ae6cac6b70
+$(DL_FILE)_BLAKE2 = 9c5d780fee12a6ce993c337bfbc4ea37128348beb90e87d4614a4b7588b5917b31e618785c35cae4768ecc1451039fe47bd17b421fff2d4b4e3f6a9ac096b8af
install : $(TARGET)