summaryrefslogtreecommitdiffstats
path: root/meta-webserver/recipes-httpd
Commit message (Collapse)AuthorAgeFilesLines
* monkey: patch CVEsGyorgy Sarvari2026-04-244-1/+324
| | | | | | | | | | | | | | | | | | | | | | | | | | These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit d31f07340fad43120f5e2ee4aee98cdec6f2717d) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* monkey: upgrade 1.8.4 -> 1.8.7Gyorgy Sarvari2026-04-241-2/+6
| | | | | | | | | | Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 22277ca3a34083c27b5053bde58237e48b0e8799) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hiawatha: upgrade 11.7 -> 11.8Gyorgy Sarvari2026-04-244-122/+1
| | | | | | | | | | | | | | Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d92fa873e5616ee7a7b25683ddfdb6849ef72d29) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.2 -> 1.28.3Gyorgy Sarvari2026-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Change: now nginx limits the size and rate of QUIC stateless reset packets. *) Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. *) Bugfix: in the ngx_http_mp4_module. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 34b3d0f4917169c5cd568cdb13796a2d75f1fbf1) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.29.1 -> 1.29.2Ankur Tyagi2026-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changes with nginx 1.29.2 *) Feature: now nginx can be built with AWS-LC. *) Bugfix: now the "ssl_protocols" directive works in a virtual server different from the default server when using OpenSSL 1.1.1 or newer. *) Bugfix: SSL handshake always failed when using TLSv1.3 with OpenSSL and client certificates and resuming a session with a different SNI value; the bug had appeared in 1.27.4. *) Bugfix: the "ignoring stale global SSL error" alerts might appear in logs when using QUIC and the "ssl_reject_handshake" directive; the bug had appeared in 1.29.0. *) Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. *) Bugfix: an XCLIENT command didn't use the xtext encoding. *) Bugfix: in SSL certificate caching during reconfiguration. https://nginx.org/en/CHANGES Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hiawatha: fix SRC_URIGyorgy Sarvari2026-03-261-1/+1
| | | | | | | The tarball was moved to a new folder on the source server. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-1642Gyorgy Sarvari2026-03-062-0/+47
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Note: this is only for v1.29.1. v1.28.x recipe contains this fix already. Pick the commit that was identified by the reporter on the oss-sec mailing list[1] [1]: https://www.openwall.com/lists/oss-security/2026/02/05/1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.1 -> 1.28.2Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: ignore CVE-2025-53859 for 1.28.1Peter Marko2026-01-201-0/+2
| | | | | | | | | | | | Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5d3936d5dd0489a984e37cc00b59e6a05d9541ac) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d25aadbbb53d54382b4b82b1f78a69d4d117fd28) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.0 -> 1.28.1Jason Schonberg2026-01-203-138/+5
| | | | | | | | | | | | | | | | Drop CVE patch which has been integrated into this new version. Solves: * CVE-2025-53859 CHANGES: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 222c6425644a39c9b7757792b47e500ca55f85b0) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* apache2: upgrade 2.4.65 -> 2.4.66Valeria Petrov2025-12-171-1/+1
| | | | | | | | | | | | | | | | | Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 220835dac9a39dda9112dcd5383aafc9ad552590) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-051-0/+1
| | | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Fix bundled mbedtls with clang-21Khem Raj2025-08-294-1/+123
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: patch CVE-2025-53859 in stablePeter Marko2025-08-252-0/+132
| | | | | | | | | Pick patch from nginx site which is also mentioned in [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade mainline 1.27.4 -> 1.29.1Peter Marko2025-08-252-10/+10
| | | | | | | Solves CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade stable 1.26.3 -> 1.28.0Peter Marko2025-08-252-6/+6
| | | | | | | | | | | | | | | | | | 2025-04-23 nginx-1.28.0 stable version has been released, incorporating new features and bug fixes from the 1.27.x mainline branch - including memory usage and CPU usage optimizations in complex SSL configurations, automatic re‑resolution of hostnames in upstream groups, performance enhancements in QUIC, OCSP validation of client SSL certificates and OCSP stapling support in the stream module, variables support in the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate, and uwsgi_limit_rate directives, the proxy_pass_trailers directive, and more. License-Update: copyright years refreshed and removed C-style comments Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.64 -> 2.4.65Wang Mingyu2025-07-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.63 -> 2.4.64Wang Mingyu2025-07-151-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Upgrade to 11.7Khem Raj2025-07-121-4/+12
| | | | | | | Enable TLS support Fix build with cmake4+ Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Upgrade to 1.8.4Khem Raj2025-07-123-23/+47
| | | | | | Use default cmake backend ( ninja ) Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-openembedded/all: adapt to UNPACKDIR changesAlexander Kanavin2025-06-255-5/+1
| | | | | | | | | | | | | Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: use -std=gnu17 for compilationYoann Congal2025-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | hiawatha does not build under -std=gnu23 which is the default of gcc15. Forcing -std=gnu17 fixes these build errors: | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:814:25: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types] | 814 | signal(SIGHUP, HUP_handler); | | ^~~~~~~~~~~ | | | | | void (*)(void) | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:88:57: note: expected '__sighandler_t' {aka 'void (*)(int)'} but argument is of type 'void (*)(void)' | 88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler) | | ~~~~~~~~~~~~~~~^~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:294:6: note: 'HUP_handler' declared here | 294 | void HUP_handler() { | | ^~~~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:72:16: note: '__sighandler_t' declared here | 72 | typedef void (*__sighandler_t) (int); | | ^~~~~~~~~~~~~~ Note: Upstream project has no published way to upstream patches. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: update HOMEPAGEYoann Congal2025-05-081-1/+1
| | | | | | | | | As noted in 11.7 changelog: https://hiawatha.leisink.net/changelog > All references to http://www.hiawatha-webserver.org/ changed to > https://hiawatha.leisink.net/. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Scrub -ffile-prefix-map in build.nice fileKhem Raj2025-04-221-1/+1
| | | | | | | Fixes QA Issue: File /usr/libexec/apache2/build/config.nice in package apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Update project websiteJason Schonberg2025-04-161-1/+1
| | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.1 -> 11.2Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.2.1. Small improvements. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.0 -> 11.1Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.1.0. Small bugfixes. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* sthttpd: Fix service unit fileAlexis Cellier2025-02-271-2/+2
| | | | | | | | | | | Update PID file path from /var/run to /run to avoid systemd warning: PIDFile= references a path below legacy directory /var/run/, updating /var/run/thttpd.pid → /run/thttpd.pid; please update the unit file accordingly. Cc: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.27.3 to 1.27.4Changqing Li2025-02-161-2/+2
| | | | | | | | | | | | | License-Update: copyright year refreshed Resolves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.26.2 to 1.26.3Changqing Li2025-02-161-1/+1
| | | | | | | | | | | Solves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES-1.26 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.62 -> 2.4.63Wang Mingyu2025-02-101-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mod-dnssd: update SRC_URIGyorgy Sarvari2025-02-031-1/+1
| | | | | | | | | Upstream repository url changed. Fixes unsuccessful fetch warning. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 10.12 -> 11.0Jason Schonberg2025-01-241-3/+2
| | | | | | | | | | | | | | The https://www.hiawatha-webserver.org/ site is defunct. So move SRC_URI to use https://hiawatha.leisink.net/ instead. Update to 11.0 while we are here. Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.0.0. Dropped support for TLSv1.0 and TLSv1.1. Configuration option MinTLSversion removed. Dropped support for HTTP Public Key Pinning (HPKP). Configuration option PublicKeyPins removed. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-1237Peter Marko2024-12-241-0/+1
| | | | | | | | | | | | | | | This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore disputed CVE CVE-2007-0086Peter Marko2024-12-191-0/+1
| | | | | | | | | | | | | | | | This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: ignore CVE-2013-1771Peter Marko2024-12-191-0/+1
| | | | | | | | This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: remove old version references from CVEsPeter Marko2024-12-191-7/+7
| | | | | | | | These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-0678 and CVE-1999-1412Peter Marko2024-12-191-0/+2
| | | | | | | These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline release version 1.27.1 -> 1.27.3Derek Straka2024-12-101-2/+2
| | | | | | | License-Update: License file negative and empty space changes Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: do not depend on zlib header and libs from hostValeria Petrov2024-10-091-1/+1
| | | | | | | | | | | | | | | | | This commit modifies the PACKAGECONFIG entry for zlib to ensure that the mod_deflate module is enabled with the appropriate zlib configuration. By adding the --with-zlib=${STAGING_LIBDIR}/../ option, we direct the configure script to use the zlib library from the staging directory instead of relying on the host system's zlib installation. Without that configure will search the host for zlib headers and lib. This change resolves build failures related to zlib dependency when mod_deflate is enabled and ensures a consistent build environment across different host configurations. Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cherokee: Remove obsolete recipeNiko Mauno2024-09-307-267/+0
| | | | | | | | | | | | | | | | | | | | This recipe depends on meta-python2, master branch of which has not been updated sine February 2022, see https://git.openembedded.org/meta-python2/log/?h=master Also, https://cherokee-project.com/doc/basics_requirements.html states The main Python releases targeted by our developers are 2.4, 2.5 and 2.6. Anything other than that is not guaranteed to work at the moment. Also, master branch of cherokee has not been updated since January 2023, see https://github.com/cherokee/webserver/commits/master/ Thus, remove the obsolete recipe and the associated packagegroup reference. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline 1.25.3 -> 1.27.1Peter Marko2024-09-172-10/+10
| | | | | | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-24989 * CVE-2024-24990 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 License-Update: copyright year refreshed Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade stable 1.26.0 -> 1.26.2Peter Marko2024-09-171-1/+1
| | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.61 -> 2.4.62Wang Mingyu2024-08-094-19/+11
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: add PACKAGECONFIG knobs for fastcgi, scgi and uwsgiMaxin John2024-07-231-5/+19
| | | | | | | | fastcgi, scgi and uwsgi are enabled by default in nginx. Provide an option to disable these features (that reduces binary size by 8%). Signed-off-by: Maxin John <maxin.john@gehealthcare.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: use update-alternatives for httpdTrevor Woerner2024-07-181-0/+4
| | | | | | | | | | | | | | | | | Busybox can optionally provide an httpd server, but by default The Yocto Project defconfig for busybox does not enable it. If it is enabled, busybox puts the resulting /usr/sbin/httpd object under the control of update-alternatives. apache2, on the other hand, does not put /usr/sbin/httpd under the control of update-alternatives. Therefore, in the off chance a user enables the busybox httpd server, it does not play well with apache2. Add update-alternatives information to apache2 so that it plays nicely with busybox which can optionally provide an httpd server at /usr/sbin/httpd. Signed-off-by: Trevor Woerner <twoerner@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Upgrade 2.4.60 -> 2.4.61Archana Polampalli2024-07-161-1/+1
| | | | | | | | | | | | Security fixes: CVE-2024-39884 Apache HTTP Server: source code disclosure with handlers configured via AddType Changelog: https://github.com/apache/httpd/blob/2.4.61/CHANGES https://httpd.apache.org/security/vulnerabilities_24.html Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2:apache2-native: sort CVE statusalba@thehoodiefirm.com2024-07-041-2/+2
| | | | | Signed-off-by: Alba Herrerías <alba@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Update CVE statusNinette Adhikari2024-07-031-0/+3
| | | | | | | | | Update CVE status for: CVE-1999-0289, CVE-2007-0450, CVE-2010-0425 The current version (2.4.6) is not affected. It only applies for Windows. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-29 20:12:41 +0000