[BACK]Return to distinfo CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / pkgsrc / www / apache24

File: [cvs.NetBSD.org] / pkgsrc / www / apache24 / distinfo (download)

Revision 1.20.2.1, Wed Jul 22 20:12:58 2015 UTC (4 years, 2 months ago) by tron
Branch: pkgsrc-2015Q2
Changes since 1.20: +4 -7 lines

Pullup ticket #4779 - requested by taca
www/apache24: security update

Revisions pulled up:
- www/apache24/Makefile                                         1.37
- www/apache24/distinfo                                         1.21
- www/apache24/patches/patch-CVE-2015-0228                      deleted
- www/apache24/patches/patch-server_core__filters.c             deleted
- www/apache24/patches/patch-server_protocol.c                  deleted

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Jul 20 00:08:35 UTC 2015

   Modified Files:
   	pkgsrc/www/apache24: Makefile distinfo
   Removed Files:
   	pkgsrc/www/apache24/patches: patch-CVE-2015-0228
   	    patch-server_core__filters.c patch-server_protocol.c

   Log Message:
   Update apache24 to 2.4.16 (Apache HTTP Server 2.4.16).

           Apache HTTP Server 2.4.16 Released

   The Apache Software Foundation and the Apache HTTP Server Project
   are pleased to announce the release of version 2.4.16 of the Apache
   HTTP Server ("Apache").  This version of Apache is our latest GA
   release of the new generation 2.4.x branch of Apache HTTPD and
   represents fifteen years of innovation by the project, and is
   recommended over all previous releases. This release of Apache is
   principally a security, feature and bug fix release. NOTE: versions
   2.4.13, 2.4.14 and 2.4.15 were not released.

   CVE-2015-3183 (cve.mitre.org)
   core: Fix chunk header parsing defect.
   Remove apr_brigade_flatten(), buffering and duplicated code from
   the HTTP_IN filter, parse chunks in a single pass with zero copy.
   Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
   authorized characters.

   CVE-2015-3185 (cve.mitre.org)
   Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
   with new ap_some_authn_required and ap_force_authn hook.

   CVE-2015-0253 (cve.mitre.org)
   core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
   with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

   CVE-2015-0228 (cve.mitre.org)
   mod_lua: A maliciously crafted websockets PING after a script
   calls r:wsupgrade() can cause a child process crash.

   Also in this release are some exciting new features including:

   *) Better default recommended SSLCipherSuite and SSLProxyCipherSuite
   *) mod_proxy_scgi: ProxySCGIInternalRedirect now allows an alternate
   response header to be used by the application
   *) Event MPM improvements
   *) Various mod_proxy_* improvements
   *) mod_log_config: Add "%{UNIT}T" format to output request duration in
   seconds, milliseconds or microseconds depending on UNIT ("s", "ms",
   "us")

$NetBSD: distinfo,v 1.20.2.1 2015/07/22 20:12:58 tron Exp $

SHA1 (httpd-2.4.16.tar.bz2) = 9963e7482700dd50c53e47abfe2d1c5068875a9c
RMD160 (httpd-2.4.16.tar.bz2) = ff29b1885d39e4ee96efdd6678c0881c921dedd8
Size (httpd-2.4.16.tar.bz2) = 5101005 bytes
SHA1 (patch-aa) = 2d92b1340aaae40289421f164346348c6d7fe839
SHA1 (patch-ab) = a3edcc20b7654e0446c7d442cda1510b23e5d324
SHA1 (patch-ac) = 9f86d845df30316d22bce677a4b176f51007ba0d
SHA1 (patch-ad) = 4ba4a9c812951f533fa316e5dbf17eaab5494157
SHA1 (patch-ae) = 5bd3bf54e792bf8a2916d7e1b49b1702b02c6903
SHA1 (patch-ag) = 50c7f0fab1cb90ac573f1c47f2d37f9c2a6247e1
SHA1 (patch-ai) = 867ac81fd14b1bd6af048ec57390d915956e9568
SHA1 (patch-al) = 02d9ade5aac4270182063d5ad413970c832ee911
SHA1 (patch-am) = acdf7198ae8b4353cfc70c8015a0f09de036b777
SHA1 (patch-aw) = 43cd64df886853ef7b75b91ed20183f329fcc9df
SHA1 (patch-include_ap__config.h) = 1d056e2d4db80ec97aaf755b6dd6aff69ed2cd96