From f0ecaf46bb8e2a1bc0f22ee8650d10cbcc746a73 Mon Sep 17 00:00:00 2001 From: Wenzong Fan Date: Sat, 6 Feb 2016 15:14:48 -0800 Subject: subversion: fix CVE-2015-3184 mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Patch is from: http://subversion.apache.org/security/CVE-2015-3184-advisory.txt (From OE-Core master rev: 29eb921ed074d86fa8d5b205a313eb3177473a63) (From OE-Core rev: 7af7a3e692a6cd0d92768024efe32bfa7d83bc8f) (From OE-Core rev: e4a1caecc5ae6b8488ec8ed7d303296af99146c0) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Robert Yang Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- meta/recipes-devtools/subversion/subversion_1.8.11.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-devtools/subversion/subversion_1.8.11.bb') diff --git a/meta/recipes-devtools/subversion/subversion_1.8.11.bb b/meta/recipes-devtools/subversion/subversion_1.8.11.bb index a5a5761013..789392950d 100644 --- a/meta/recipes-devtools/subversion/subversion_1.8.11.bb +++ b/meta/recipes-devtools/subversion/subversion_1.8.11.bb @@ -12,6 +12,7 @@ inherit gettext pythonnative SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://libtool2.patch \ file://disable_macos.patch \ + file://subversion-CVE-2015-3184.patch \ " SRC_URI[md5sum] = "766a89bbbb388f8eb76166672d3b9e49" SRC_URI[sha256sum] = "10b056420e1f194c12840368f6bf58842e6200f9cb8cc5ebbf9be2e89e56e4d9" -- cgit v1.2.3-54-g00ecf