linux/meta-openembedded.git/meta-webserver/recipes-httpd/apache2, branch walnascar

apache2: patch CVE-2025-54090

2025-10-13T07:21:31+00:00

https://nvd.nist.gov/vuln/detail/CVE-2025-54090 A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Signed-off-by: Gyorgy Sarvari

apache2: upgrade 2.4.63 -> 2.4.64

2025-09-06T14:13:59+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 207b98bcd720fc4253b13284962ea1b0f84bf7e9) Signed-off-by: Archana Polampalli Signed-off-by: Gyorgy Sarvari

apache2: Scrub -ffile-prefix-map in build.nice file

2025-05-17T17:56:50+00:00

Fixes QA Issue: File /usr/libexec/apache2/build/config.nice in package apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Khem Raj (cherry picked from commit f00a3f153a0b2a1bd9e77f24f857df12b41bcbba) Signed-off-by: Armin Kuster

apache2: upgrade 2.4.62 -> 2.4.63

2025-02-10T16:45:35+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

apache2: ignore CVE-1999-1237

2024-12-24T16:23:09+00:00

This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: ignore disputed CVE CVE-2007-0086

2024-12-19T21:00:33+00:00

This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: remove old version references from CVEs

2024-12-19T21:00:32+00:00

These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: ignore CVE-1999-0678 and CVE-1999-1412

2024-12-19T21:00:32+00:00

These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: do not depend on zlib header and libs from host

2024-10-09T22:47:23+00:00

This commit modifies the PACKAGECONFIG entry for zlib to ensure that the mod_deflate module is enabled with the appropriate zlib configuration. By adding the --with-zlib=${STAGING_LIBDIR}/../ option, we direct the configure script to use the zlib library from the staging directory instead of relying on the host system's zlib installation. Without that configure will search the host for zlib headers and lib. This change resolves build failures related to zlib dependency when mod_deflate is enabled and ensures a consistent build environment across different host configurations. Signed-off-by: Valeria Petrov Signed-off-by: Khem Raj

apache2: upgrade 2.4.61 -> 2.4.62

2024-08-09T21:25:12+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj