similarity index 99%
rename from meta-webserver/recipes-httpd/apache2/apache2_2.4.70.bb
rename to meta-webserver/recipes-httpd/apache2/apache2_2.4.71.bb
@@ -27,7 +27,7 @@ SRC_URI:append:class-target = " \
"
LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3"
-SRC_URI[sha256sum] = "1eefd7dc95836c5872894ce8e6a37f773d5a6764f0766869d39b8bcf0b1bafc3"
+SRC_URI[sha256sum] = "2bc5da5a33c247341de082717d4ebcb5cb49e8b73a05b7fddf7d5d6dc2f8de62"
S = "${UNPACKDIR}/httpd-${PV}"
@@ -134,6 +134,7 @@ do_install:append:class-target() {
-e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g; s,-ffile-prefix-map[^ ]*,,g' \
-e 's,${HOSTTOOLS_DIR}/,,g' \
-e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \
+ -e 's,${HOME},,g' \
-e 's,APU_CONFIG = .*,APU_CONFIG = ,g' ${D}${libexecdir}/${PN}/build/config_vars.mk
sed -i -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \
Fix [buildpaths] qa issue in config_vars.mk ERROR: apache2-2.4.71-r0 do_package_qa: QA Issue: File /usr/libexec/apache2/build/config_vars.mk in package apache2-dev contains a reference to the build host HOME directory. Changes with Apache 2.4.71 *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in assign_headers (cve.mitre.org) Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. Credits: Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) (cve.mitre.org) Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69 and 2.4.70. Credits: Gustavo Aiello *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads to child process crash (cve.mitre.org) NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70. Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability Research Institute, working with 360 TuLongFeng. *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain. New directive MDHttpProxyCACertificateFile sets the CA certificates used to verify an HTTPS proxy. [Michael Kaufmann <mail michael-kaufmann.ch>] *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a length byte with the high bit set is no longer sign-extended, fixing inflation of gzip streams that carry an extra field. [arshiya tabasum <arshi bugqore.com>] *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host they are configured in, and merge the proxy entries of the main server and of the virtual host, logging a warning when both have some. PR 70207. [Arturo Bernal] *) mod_dav: Fix handling of invalid or overflowing "Timeout:" request headers, which could silently grant a lock with an already-expired timeout instead of the RFC 4918 maximum. PR 65788 [Arturo Bernal] *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests instead of rejecting them as malformed. PR 70195. [Arturo Bernal <abernal apache.org>] *) mod_http2: Fix duplicate logging of header limit violations. [Michael Kaufmann <mail michael-kaufmann.ch>] *) mod_http2: Fix a crash creating an HTTP/2 session with "H2PushDiarySize 0" and debug logging enabled. [Joe Orton] *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the indirect-lock key length with the wrong width, which could read back a wrong length on big-endian platforms. PR 70299 [Arturo Bernal] *) mod_remoteip: Log a connection closed before a complete PROXY protocol header was received at info level rather than as an error. PR 63893. [Joe Orton] Signed-off-by: Jason Schonberg <schonm@gmail.com> --- .../apache2/{apache2_2.4.70.bb => apache2_2.4.71.bb} | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.70.bb => apache2_2.4.71.bb} (99%)