From patchwork Wed Nov 11 22:40:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 10723 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jPz4m5QM3z3wh2 for ; Wed, 11 Nov 2026 22:40:40 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jPz4m3MFbz5Gf for ; Wed, 11 Nov 2026 22:40:40 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jPz4m2bbgz2yK8 for ; Wed, 11 Nov 2026 22:40:40 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jPz4j5Fq3z2xMt for ; Wed, 11 Nov 2026 22:40:37 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jPz4h6HxPz7b; Wed, 11 Nov 2026 22:40:36 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1794436837; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dUIQiRuTWhagHTeRk0fCHFNQQrdqqD+WKbQFjfaucCA=; b=67ZbqR45Bx71uu8oN6ip7UVhtgfqDzlmNkqy2ywx0NVobj5orx+h9USOeXMjHHglvTDSCc DUjDLwXrBzwfYnBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1794436837; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dUIQiRuTWhagHTeRk0fCHFNQQrdqqD+WKbQFjfaucCA=; b=iVsaowKASJaaQ5VXyvpvTOsnEVQ+N2gr3+x8eGXbCkZ8Ez63wGKHFqOnNWpALzIdWArd2k jKE+Zwde4dkjmxezH4aqK6bCXXUtuuGWUsWAlHG7YhLI0xscnb5Af9Gut2y9tQ7RBd5hnL 63dl06ZmNARWhKPXJxokKj/TY3PvLFxJNElLlj5S4l8uuVxsVVMS2icC0dyFTfWyrqwV3+ 7kly++7NWYOoDIITqfB+y20IvWIowRUeKMW5TlXl3uyH0/wQtpc8CXRot5TqnWPV4a7JBP +FdenGrqhoZIH2OXOZmWpsw+yvsEykB5nyxGRWs6yhd2zP+rfYfFhFZOUrGS2w== From: Matthias Fischer To: development@lists.ipfire.org Cc: Matthias Fischer Subject: [PATCH] apache: Update to 2.4.71 Date: Wed, 11 Nov 2026 23:40:18 +0100 Message-ID: <20261111224028.3088481-1-matthias.fischer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.71 "Changes with Apache 2.4.71 *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in assign_headers (cve.mitre.org) Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. Credits: Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) (cve.mitre.org) Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69 and 2.4.70. Credits: Gustavo Aiello *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads to child process crash (cve.mitre.org) NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70. Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability Research Institute, working with 360 TuLongFeng. *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain. New directive MDHttpProxyCACertificateFile sets the CA certificates used to verify an HTTPS proxy. [Michael Kaufmann ] *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a length byte with the high bit set is no longer sign-extended, fixing inflation of gzip streams that carry an extra field. [arshiya tabasum ] *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host they are configured in, and merge the proxy entries of the main server and of the virtual host, logging a warning when both have some. PR 70207. [Arturo Bernal] *) mod_dav: Fix handling of invalid or overflowing "Timeout:" request headers, which could silently grant a lock with an already-expired timeout instead of the RFC 4918 maximum. PR 65788 [Arturo Bernal] *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests instead of rejecting them as malformed. PR 70195. [Arturo Bernal ] *) mod_http2: Fix duplicate logging of header limit violations. [Michael Kaufmann ] *) mod_http2: Fix a crash creating an HTTP/2 session with "H2PushDiarySize 0" and debug logging enabled. [Joe Orton] *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the indirect-lock key length with the wrong width, which could read back a wrong length on big-endian platforms. PR 70299 [Arturo Bernal] *) mod_remoteip: Log a connection closed before a complete PROXY protocol header was received at info level rather than as an error. PR 63893. [Joe Orton]" Signed-off-by: Matthias Fischer --- config/rootfiles/common/apache2 | 9 +++++++++ lfs/apache2 | 4 ++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2 index 9206fcffd..0a8aac7a9 100644 --- a/config/rootfiles/common/apache2 +++ b/config/rootfiles/common/apache2 @@ -498,6 +498,7 @@ srv/web/ipfire/html/captive #srv/web/ipfire/manual/howto/ssi.html.ja.utf8 #srv/web/ipfire/manual/howto/ssi.html.ko.euc-kr #srv/web/ipfire/manual/images +#srv/web/ipfire/manual/images/README.md #srv/web/ipfire/manual/images/apache_header.gif #srv/web/ipfire/manual/images/bal-man-b.png #srv/web/ipfire/manual/images/bal-man-w.png @@ -534,8 +535,16 @@ srv/web/ipfire/html/captive #srv/web/ipfire/manual/images/reverse-proxy-arch.png #srv/web/ipfire/manual/images/rewrite_backreferences.png #srv/web/ipfire/manual/images/rewrite_backreferences.svg +#srv/web/ipfire/manual/images/rewrite_l_flag_looping.png +#srv/web/ipfire/manual/images/rewrite_l_flag_looping.svg +#srv/web/ipfire/manual/images/rewrite_module_order.png +#srv/web/ipfire/manual/images/rewrite_module_order.svg +#srv/web/ipfire/manual/images/rewrite_path_stripping.png +#srv/web/ipfire/manual/images/rewrite_path_stripping.svg #srv/web/ipfire/manual/images/rewrite_process_uri.png #srv/web/ipfire/manual/images/rewrite_process_uri.svg +#srv/web/ipfire/manual/images/rewrite_simplified_overview.png +#srv/web/ipfire/manual/images/rewrite_simplified_overview.svg #srv/web/ipfire/manual/images/right.gif #srv/web/ipfire/manual/images/ssl_intro_fig1.gif #srv/web/ipfire/manual/images/ssl_intro_fig1.png diff --git a/lfs/apache2 b/lfs/apache2 index 3f9759d10..dbd5863b7 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.68 +VER = 2.4.71 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5c2d4b21915db3ca62ee374e89bb04dcec21a6f2f1334f6306db079de03a974709ef71f3728c56e020c844e331b800306fcf5a865dcd2e02576d41ae6cac6b70 +$(DL_FILE)_BLAKE2 = 9c5d780fee12a6ce993c337bfbc4ea37128348beb90e87d4614a4b7588b5917b31e618785c35cae4768ecc1451039fe47bd17b421fff2d4b4e3f6a9ac096b8af install : $(TARGET)