linux/meta-openembedded.git/meta-webserver/recipes-httpd/apache2, branch whinlatter

apache2: upgrade 2.4.65 -> 2.4.66

2025-12-17T08:27:18+00:00

Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov Signed-off-by: Khem Raj (cherry picked from commit 220835dac9a39dda9112dcd5383aafc9ad552590) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

apache2: ignore CVE-2025-3891

2025-10-06T04:52:27+00:00

The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

apache2: upgrade 2.4.64 -> 2.4.65

2025-07-30T15:03:04+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

apache2: upgrade 2.4.63 -> 2.4.64

2025-07-16T06:54:14+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

meta-openembedded/all: adapt to UNPACKDIR changes

2025-06-25T13:44:52+00:00

Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin Signed-off-by: Khem Raj

apache2: Scrub -ffile-prefix-map in build.nice file

2025-04-22T16:10:56+00:00

Fixes QA Issue: File /usr/libexec/apache2/build/config.nice in package apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Khem Raj

apache2: upgrade 2.4.62 -> 2.4.63

2025-02-10T16:45:35+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

apache2: ignore CVE-1999-1237

2024-12-24T16:23:09+00:00

This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: ignore disputed CVE CVE-2007-0086

2024-12-19T21:00:33+00:00

This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

apache2: remove old version references from CVEs

2024-12-19T21:00:32+00:00

These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko Signed-off-by: Khem Raj