From patchwork Wed Mar 16 16:09:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 5349 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4KJZwK0cJYz3xp3 for ; Wed, 16 Mar 2022 16:09:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4KJZwH2kfgzL7; Wed, 16 Mar 2022 16:09:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4KJZwH23HXz2ySt; Wed, 16 Mar 2022 16:09:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4KJZwF73kTz2xLb for ; Wed, 16 Mar 2022 16:09:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4KJZwF0pMYzBY for ; Wed, 16 Mar 2022 16:09:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1647446957; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=NUyV5axxP7Csy/yDb3ZucShqsj7ILKoDCJsetnkEcRc=; b=wZu0ielUYyZKl3V6AlG9rDqlheuXbjUneNgZJQ7yMQCrtDiUqdMdA0LY7om/6EN17dPWUE /KpGGVr0exPfJFCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1647446957; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=NUyV5axxP7Csy/yDb3ZucShqsj7ILKoDCJsetnkEcRc=; b=Fq37oVALk6WoOIebcy+ze/MzPz4o0/Rmm4eLjCzoZL0lbY8BEM2TW1mbr4ISe60s0auWHf peFFZyCmPnulRHdHJ9s8EicwOf3saT7WJ3RWPz3chUmrg5+vz7SZiLwL/4wAf1HnotryXh 0StqaE4rRAa8KDWxF7RWS4TJxuGiOW453aUEo4IRx63iX0BdkIbZYjfHxlRmYrsa1GSvi2 d6MvU+pZrCVMCgJqf1fVwaRileHKbTr3ps176D6rKP6JKJCRLb7THhgEts6gA18A9RGVHc lScyuDr85tv7HYHB78LRJpNGlboxoAp0fSI/jbSl/9qvTW0QixkEXJabgd7ERA== From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH] apache: Update to 2.4.53 Date: Wed, 16 Mar 2022 17:09:12 +0100 Message-Id: <20220316160912.1569-1-matthias.fischer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.53 Short summary of the most important SECURITY changes: "Changes with Apache 2.4.53 *) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds (cve.mitre.org) Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions. Credits: Ronald Crane (Zippenhop LLC) *) SECURITY: CVE-2022-22721: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (cve.mitre.org) If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier. Credits: Anonymous working with Trend Micro Zero Day Initiative *) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org) Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling Credits: James Kettle *) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of in r:parsebody (cve.mitre.org) A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier. Credits: Chamal De Silva ..." Signed-off-by: Matthias Fischer Reviewed-by: Adolf Belka --- lfs/apache2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 226058a22..6771ff903 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team # +# Copyright (C) 2007-2022 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 2.4.52 +VER = 2.4.53 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = a94ae42b84309d5ef6e613ae825b92fa +$(DL_FILE)_MD5 = f594f137137b5bdff3998dc17e3e9526 install : $(TARGET)