diff mbox series

[1/1] package/apache: security bump version to 2.4.59

Message ID 20240404151115.56677-1-bernd@kuhls.net
State Accepted
Headers show
Series [1/1] package/apache: security bump version to 2.4.59 | expand

Commit Message

Bernd Kuhls April 4, 2024, 3:11 p.m. UTC 
Changelog: https://dlcdn.apache.org/httpd/CHANGES_2.4.59

Fixes CVE-2023-38709, CVE-2024-27316 & CVE-2024-24795.

Removed patch which is included in this release.

Updated _SITE and hash file URLs according to
https://httpd.apache.org/download.cgi#apache24

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
 ...emove-dependency-on-xmlstring-header.patch | 47 -------------------
 package/apache/apache.hash                    |  6 +--
 package/apache/apache.mk                      |  4 +-
 3 files changed, 5 insertions(+), 52 deletions(-)
 delete mode 100644 package/apache/0004-mod_xml2enc-remove-dependency-on-xmlstring-header.patch

Comments

Peter Korsgaard April 6, 2024, 7:42 a.m. UTC | #1 
>>>>> "Bernd" == Bernd Kuhls <bernd@kuhls.net> writes:

 > Changelog: https://dlcdn.apache.org/httpd/CHANGES_2.4.59
 > Fixes CVE-2023-38709, CVE-2024-27316 & CVE-2024-24795.

 > Removed patch which is included in this release.

 > Updated _SITE and hash file URLs according to
 > https://httpd.apache.org/download.cgi#apache24

 > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Committed, thanks.
diff mbox series

Patch

diff --git a/package/apache/0004-mod_xml2enc-remove-dependency-on-xmlstring-header.patch b/package/apache/0004-mod_xml2enc-remove-dependency-on-xmlstring-header.patch
deleted file mode 100644
index 8ff7076589..0000000000
--- a/package/apache/0004-mod_xml2enc-remove-dependency-on-xmlstring-header.patch
+++ /dev/null
@@ -1,47 +0,0 @@ 
-From 27a68e54b7c6d2ae80dca396fd2727852897dab1 Mon Sep 17 00:00:00 2001
-From: Eric Covener <covener@apache.org>
-Date: Tue, 21 Nov 2023 12:58:47 +0000
-Subject: [PATCH] mod_xml2enc: remove dependency on xmlstring header
-
-Submitted by: ttachi <tachihara@hotmail.com>
-
-Github: closes #393
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1914013 13f79535-47bb-0310-9956-ffa450edef68
-
-Upstream: https://github.com/apache/httpd/commit/27a68e54b7c6d2ae80dca396fd2727852897dab1
-
-Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
----
- changes-entries/xmlchar.txt   | 2 ++
- modules/filters/mod_xml2enc.c | 6 +++---
- 2 files changed, 5 insertions(+), 3 deletions(-)
- create mode 100644 changes-entries/xmlchar.txt
-
-diff --git a/changes-entries/xmlchar.txt b/changes-entries/xmlchar.txt
-new file mode 100644
-index 00000000000..d0e06300411
---- /dev/null
-+++ b/changes-entries/xmlchar.txt
-@@ -0,0 +1,2 @@
-+ *) mod_xml2enc: Tolerate libxml2 2.12.0 and later.
-+    [ttachi <tachihara AT hotmail.com>]
-diff --git a/modules/filters/mod_xml2enc.c b/modules/filters/mod_xml2enc.c
-index 34f8e8ee090..e8ee2647955 100644
---- a/modules/filters/mod_xml2enc.c
-+++ b/modules/filters/mod_xml2enc.c
-@@ -206,11 +206,11 @@ static void sniff_encoding(request_rec* r, xml2ctx* ctx)
-             }
-         }
-     }
--  
-+
-     /* to sniff, first we look for BOM */
-     if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) {
--        ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf,
--                                             ctx->bytes); 
-+        ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf,
-+                                             ctx->bytes);
-         if (HAVE_ENCODING(ctx->xml2enc)) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432)
-                           "Got charset from XML rules.") ;
diff --git a/package/apache/apache.hash b/package/apache/apache.hash
index 854bc85dcc..84248761b9 100644
--- a/package/apache/apache.hash
+++ b/package/apache/apache.hash
@@ -1,5 +1,5 @@ 
-# From https://archive.apache.org/dist/httpd/httpd-2.4.58.tar.bz2.{sha256,sha512}
-sha256  fa16d72a078210a54c47dd5bef2f8b9b8a01d94909a51453956b3ec6442ea4c5  httpd-2.4.58.tar.bz2
-sha512  d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1  httpd-2.4.58.tar.bz2
+# From https://downloads.apache.org/httpd/httpd-2.4.59.tar.bz2.{sha256,sha512}
+sha256  ec51501ec480284ff52f637258135d333230a7d229c3afa6f6c2f9040e321323  httpd-2.4.59.tar.bz2
+sha512  209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2  httpd-2.4.59.tar.bz2
 # Locally computed
 sha256  47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43  LICENSE
diff --git a/package/apache/apache.mk b/package/apache/apache.mk
index 3efa6b0ac1..1b095c5eb1 100644
--- a/package/apache/apache.mk
+++ b/package/apache/apache.mk
@@ -4,9 +4,9 @@ 
 #
 ################################################################################
 
-APACHE_VERSION = 2.4.58
+APACHE_VERSION = 2.4.59
 APACHE_SOURCE = httpd-$(APACHE_VERSION).tar.bz2
-APACHE_SITE = https://downloads.apache.org/httpd
+APACHE_SITE = https://dlcdn.apache.org/httpd
 APACHE_LICENSE = Apache-2.0
 APACHE_LICENSE_FILES = LICENSE
 APACHE_CPE_ID_VENDOR = apache