From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25124C433F5 for ; Sat, 18 Sep 2021 06:47:16 +0000 (UTC) Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6C916610A4 for ; Sat, 18 Sep 2021 06:47:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 6C916610A4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=free.fr Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.buildroot.org Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 0847E425F3; Sat, 18 Sep 2021 06:47:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dCvM4lWWxIml; Sat, 18 Sep 2021 06:47:14 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by smtp4.osuosl.org (Postfix) with ESMTP id 68421425EC; Sat, 18 Sep 2021 06:47:13 +0000 (UTC) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id C06A51BF957 for ; Sat, 18 Sep 2021 06:47:11 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id AF76B842E2 for ; Sat, 18 Sep 2021 06:47:11 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Authentication-Results: smtp1.osuosl.org (amavisd-new); dkim=pass (2048-bit key) header.d=free.fr Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NFVyQMoCqwBx for ; Sat, 18 Sep 2021 06:47:10 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.8.0 Received: from smtp5-g21.free.fr (smtp5-g21.free.fr [212.27.42.5]) by smtp1.osuosl.org (Postfix) with ESMTPS id 52B31842DE for ; Sat, 18 Sep 2021 06:47:10 +0000 (UTC) Received: from ymorin.is-a-geek.org (unknown [IPv6:2a01:cb19:8b51:cb00:4db3:5a06:f3b2:1f85]) (Authenticated sender: yann.morin.1998@free.fr) by smtp5-g21.free.fr (Postfix) with ESMTPSA id 312155FF96; Sat, 18 Sep 2021 08:47:01 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=free.fr; s=smtp-20201208; t=1631947627; bh=vZVv2+fglCYqlSgFajD0QoU2Zkc+fYJzIIla58cuiqE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=SYO7TrJzWM97XFMbi5r483yxDctczEdgvcVJBhqemCrSLc+5qXO8fRXOFr5TvswIg jV7RF5jMNtY+fHcrClG0MT2HYgHThlL9nfMJ7n1f8XdLOfJC8fhziZ1+KMn69udIt9 n/7Uz+M5vpRtwe8G0SELGqJvNQuCs8MaTzTKE2gKHeRw5W5rFd5OvriTtbO0Cj0VE5 wa+yMoAIpg9Nn5YPciDtQ/PRJuisPLLInJE0NudRQNC09C4JTZCFrLeKLFAGRS74mx zVra2WRnE0g2+m2/27g319zW5zOaGcPMegq7UgGn8J/ltDSEHwloHatP6Ycmka/Cl0 8BYH3xSgVWlCA== Received: by ymorin.is-a-geek.org (sSMTP sendmail emulation); Sat, 18 Sep 2021 08:47:00 +0200 Date: Sat, 18 Sep 2021 08:47:00 +0200 From: "Yann E. MORIN" To: Fabrice Fontaine Message-ID: <20210918064700.GB1053080@scaer> References: <20210917221934.631955-1-fontaine.fabrice@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20210917221934.631955-1-fontaine.fabrice@gmail.com> User-Agent: Mutt/1.5.22 (2013-10-16) Subject: Re: [Buildroot] [PATCH 1/1] package/apache: security bump to version 2.4.49 X-BeenThere: buildroot@lists.buildroot.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Bernd Kuhls , buildroot@buildroot.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: buildroot-bounces@lists.buildroot.org Sender: "buildroot" Fabrice, All, On 2021-09-18 00:19 +0200, Fabrice Fontaine spake thusly: > Fix CVE-2021-33193: A crafted method sent through HTTP/2 will bypass > validation and be forwarded by mod_proxy, which can lead to request > splitting or cache poisoning. This issue affects Apache HTTP Server > 2.4.17 to 2.4.48. > > https://github.com/apache/httpd/blob/2.4.49/CHANGES > > Signed-off-by: Fabrice Fontaine Applied to master, thanks. Regards, Yann E. MORIN. > --- > package/apache/apache.hash | 6 +++--- > package/apache/apache.mk | 2 +- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/package/apache/apache.hash b/package/apache/apache.hash > index c03934b40a..49efefebb9 100644 > --- a/package/apache/apache.hash > +++ b/package/apache/apache.hash > @@ -1,5 +1,5 @@ > -# From http://archive.apache.org/dist/httpd/httpd-2.4.46.tar.bz2.{sha256,sha512} > -sha256 1bc826e7b2e88108c7e4bf43c026636f77a41d849cfb667aa7b5c0b86dbf966c httpd-2.4.48.tar.bz2 > -sha512 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724 httpd-2.4.48.tar.bz2 > +# From http://archive.apache.org/dist/httpd/httpd-2.4.49.tar.bz2.{sha256,sha512} > +sha256 65b965d6890ea90d9706595e4b7b9365b5060bec8ea723449480b4769974133b httpd-2.4.49.tar.bz2 > +sha512 418e277232cf30a81d02b8554e31aaae6433bbea842bdb81e47a609469395cc4891183fb6ee02bd669edb2392c2007869b19da29f5998b8fd5c7d3142db310dd httpd-2.4.49.tar.bz2 > # Locally computed > sha256 47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43 LICENSE > diff --git a/package/apache/apache.mk b/package/apache/apache.mk > index 365dc9a72e..ae2fb70535 100644 > --- a/package/apache/apache.mk > +++ b/package/apache/apache.mk > @@ -4,7 +4,7 @@ > # > ################################################################################ > > -APACHE_VERSION = 2.4.48 > +APACHE_VERSION = 2.4.49 > APACHE_SOURCE = httpd-$(APACHE_VERSION).tar.bz2 > APACHE_SITE = http://archive.apache.org/dist/httpd > APACHE_LICENSE = Apache-2.0 > -- > 2.33.0 > > _______________________________________________ > buildroot mailing list > buildroot@lists.buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot -- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list buildroot@lists.buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot