| Message ID | 20261113040121.1553219-1-schonm@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-webserver] apache2: upgrade 2.4.70 -> 2.4.71 | expand |
On Thu, Nov 12, 2026 at 8:01 PM J. S. via openembedded-devel <schonm= gmail.com@lists.openembedded.org> wrote: > Fix [buildpaths] qa issue in config_vars.mk > > Changes with Apache 2.4.71 > > *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in > assign_headers (cve.mitre.org) > Concurrent Execution using Shared Resource with Improper > Synchronization vulnerability in Apache HTTP Server's mod_http2 > in assign_headers() can lead to RCE. > This issue affects Apache HTTP Server: from 2.4.55 through > 2.4.70. > Affected releases of mod_h2 from GitHub: from 2.0.8 through > 2.0.42. > Credits: Anthropic's OSS Scanner, as vulnerability > ANT-2026-MAPKT6MZ > > *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer > overwrite (after CVE-2026-63292) (cve.mitre.org) > Stack-based buffer overflow vulnerability in Apache HTTP > Server's mod_vhost_alias (after CVE-2026-63292) > This issue affects Apache HTTP Server: 2.4.69 and 2.4.70. > Credits: Gustavo Aiello > > *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads > to child process crash (cve.mitre.org) > NULL pointer dereference vulnerability in Apache HTTP Server's > mod_md during HTTP request processing. > This issue affects Apache HTTP Server: from 2.4.30 through > 2.4.70. > Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability > Research Institute, working with 360 TuLongFeng. > > *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per > MDomain. > New directive MDHttpProxyCACertificateFile sets the CA certificates > used to verify an HTTPS proxy. > [Michael Kaufmann <mail michael-kaufmann.ch>] > > *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so > a > length byte with the high bit set is no longer sign-extended, fixing > inflation of gzip streams that carry an extra field. > [arshiya tabasum <arshi bugqore.com>] > > *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the > virtual host > they are configured in, and merge the proxy entries of the main server > and of the virtual host, logging a warning when both have some. > PR 70207. [Arturo Bernal] > > *) mod_dav: Fix handling of invalid or overflowing "Timeout:" > request headers, which could silently grant a lock with an > already-expired timeout instead of the RFC 4918 maximum. > PR 65788 [Arturo Bernal] > > *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests > instead of rejecting them as malformed. PR 70195. > [Arturo Bernal <abernal apache.org>] > > *) mod_http2: Fix duplicate logging of header limit violations. > [Michael Kaufmann <mail michael-kaufmann.ch>] > > *) mod_http2: Fix a crash creating an HTTP/2 session with > "H2PushDiarySize 0" and debug logging enabled. [Joe Orton] > > *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the > indirect-lock key length with the wrong width, which could read > back a wrong length on big-endian platforms. PR 70299 > [Arturo Bernal] > > *) mod_remoteip: Log a connection closed before a complete PROXY protocol > header was received at info level rather than as an error. PR 63893. > [Joe Orton] > > Signed-off-by: Jason Schonberg <schonm@gmail.com> > --- > .../apache2/{apache2_2.4.70.bb => apache2_2.4.71.bb} | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.70.bb => > apache2_2.4.71.bb} (99%) > > diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb > b/meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb > similarity index 99% > rename from meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb > rename to meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb > index f34d622495..35c4b2f8b9 100644 > --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb > +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb > @@ -27,7 +27,7 @@ SRC_URI:append:class-target = " \ > " > > LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3" > -SRC_URI[sha256sum] = > "1eefd7dc95836c5872894ce8e6a37f773d5a6764f0766869d39b8bcf0b1bafc3" > +SRC_URI[sha256sum] = > "2bc5da5a33c247341de082717d4ebcb5cb49e8b73a05b7fddf7d5d6dc2f8de62" > > S = "${UNPACKDIR}/httpd-${PV}" > > @@ -134,6 +134,7 @@ do_install:append:class-target() { > -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ > ]*,,g; s,-ffile-prefix-map[^ ]*,,g' \ > -e 's,${HOSTTOOLS_DIR}/,,g' \ > -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ > + -e 's,${HOME},,g' \ > why is this needed ? > -e 's,APU_CONFIG = .*,APU_CONFIG = ,g' > ${D}${libexecdir}/${PN}/build/config_vars.mk > > sed -i -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \ > -- > 2.43.0 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#132222): > https://lists.openembedded.org/g/openembedded-devel/message/132222 > Mute This Topic: https://lists.openembedded.org/mt/122242379/1997914 > Group Owner: openembedded-devel+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ > raj.khem@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb similarity index 99% rename from meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb rename to meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb index f34d622495..35c4b2f8b9 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb @@ -27,7 +27,7 @@ SRC_URI:append:class-target = " \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3" -SRC_URI[sha256sum] = "1eefd7dc95836c5872894ce8e6a37f773d5a6764f0766869d39b8bcf0b1bafc3" +SRC_URI[sha256sum] = "2bc5da5a33c247341de082717d4ebcb5cb49e8b73a05b7fddf7d5d6dc2f8de62" S = "${UNPACKDIR}/httpd-${PV}" @@ -134,6 +134,7 @@ do_install:append:class-target() { -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g; s,-ffile-prefix-map[^ ]*,,g' \ -e 's,${HOSTTOOLS_DIR}/,,g' \ -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ + -e 's,${HOME},,g' \ -e 's,APU_CONFIG = .*,APU_CONFIG = ,g' ${D}${libexecdir}/${PN}/build/config_vars.mk sed -i -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \
Fix [buildpaths] qa issue in config_vars.mk Changes with Apache 2.4.71 *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in assign_headers (cve.mitre.org) Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. Credits: Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) (cve.mitre.org) Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69 and 2.4.70. Credits: Gustavo Aiello *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads to child process crash (cve.mitre.org) NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70. Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability Research Institute, working with 360 TuLongFeng. *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain. New directive MDHttpProxyCACertificateFile sets the CA certificates used to verify an HTTPS proxy. [Michael Kaufmann <mail michael-kaufmann.ch>] *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a length byte with the high bit set is no longer sign-extended, fixing inflation of gzip streams that carry an extra field. [arshiya tabasum <arshi bugqore.com>] *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host they are configured in, and merge the proxy entries of the main server and of the virtual host, logging a warning when both have some. PR 70207. [Arturo Bernal] *) mod_dav: Fix handling of invalid or overflowing "Timeout:" request headers, which could silently grant a lock with an already-expired timeout instead of the RFC 4918 maximum. PR 65788 [Arturo Bernal] *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests instead of rejecting them as malformed. PR 70195. [Arturo Bernal <abernal apache.org>] *) mod_http2: Fix duplicate logging of header limit violations. [Michael Kaufmann <mail michael-kaufmann.ch>] *) mod_http2: Fix a crash creating an HTTP/2 session with "H2PushDiarySize 0" and debug logging enabled. [Joe Orton] *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the indirect-lock key length with the wrong width, which could read back a wrong length on big-endian platforms. PR 70299 [Arturo Bernal] *) mod_remoteip: Log a connection closed before a complete PROXY protocol header was received at info level rather than as an error. PR 63893. [Joe Orton] Signed-off-by: Jason Schonberg <schonm@gmail.com> --- .../apache2/{apache2_2.4.70.bb => apache2_2.4.71.bb} | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.70.bb => apache2_2.4.71.bb} (99%)