summaryrefslogtreecommitdiffstats
path: root/meta-webserver/recipes-httpd
Commit message (Collapse)AuthorAgeFilesLines
* apache2: upgrade 2.4.66 -> 2.4.67Liyin Zhang2026-05-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | Security fixes: - CVE-2026-34059 - CVE-2026-34032 - CVE-2026-33857 - CVE-2026-33523 - CVE-2026-33007 - CVE-2026-33006 - CVE-2026-29169 - CVE-2026-29168 - CVE-2026-28780 - CVE-2026-24072 - CVE-2026-23918 See: https://archive.apache.org/dist/httpd/CHANGES_2.4.67 Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 3ec333fc064b0088649a3dbfb69e3f3dd06e93bd) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* monkey: patch CVEsGyorgy Sarvari2026-04-204-1/+324
| | | | | | | | | | | | | | | | | | | | | | | | These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* monkey: upgrade 1.8.4 -> 1.8.7Gyorgy Sarvari2026-04-201-2/+6
| | | | | | | | Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* hiawatha: Upgrade to 12.1 releaseKhem Raj2026-04-161-1/+1
| | | | | | | | | | | | - HTTP/2 support added via the nghttp2 library (credits to Heiko Zimmermann) — noted as experimental, so testing carefully before enabling on production servers is recommended. - mbed TLS updated from 4.0.0 to 4.1.0. - ssi-cgi removed — the release notes suggest using Hiawatha's XSLT support as a more advanced alternative. Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* sthttpd: disable C23 support to fix configure checkKhem Raj2026-04-161-0/+2
| | | | | | | | Set ac_cv_prog_cc_c23=no to prevent autoconf from detecting C23 compiler support, avoiding potential build failures as the package is not yet fully ported to support C23 standard. Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* nginx: upgrade 1.29.6 -> 1.29.7Gyorgy Sarvari2026-03-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Feature: the "multipath" parameter of the "listen" directive. *) Feature: the "local" parameter of the "keepalive" directive in the "upstream" block. *) Change: now the "keepalive" directive in the "upstream" block is enabled by default. *) Change: now ngx_http_proxy_module supports keepalive by default; the default value for "proxy_http_version" is "1.1"; the "Connection" proxy header is not sent by default anymore. *) Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream if buffered body was used in the ngx_http_grpc_module. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* nginx: upgrade 1.28.2 -> 1.28.3Gyorgy Sarvari2026-03-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Change: now nginx limits the size and rate of QUIC stateless reset packets. *) Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. *) Bugfix: in the ngx_http_mp4_module. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* hiawatha: Fix checksum mismatch againKhem Raj2026-03-241-1/+1
| | | | Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* hiawatha: Fix checksum mismatchAlper Ak2026-03-211-1/+1
| | | | | | | Update the sha256sum to match the current upstream archive. Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* sthttpd: remove obsolete CVE_STATUSGyorgy Sarvari2026-03-201-2/+0
| | | | | | | The CVE is now tracked with the correct version info by NVD. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.29.5 -> 1.29.6Ankur Tyagi2026-03-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: * Feature: session affinity support; the "sticky" directive in the "upstream" block of the "http" module; the "server" directive supports the "route" and "drain" parameters. * Change: now nginx limits the size and rate of QUIC stateless reset packets. * Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. * Bugfix: "[crit] cache file ... contains invalid header" messages might appear in logs when sending a cached HTTP/2 response. * Bugfix: proxying to scgi backends might not work when using chunked transfer encoding and the "scgi_request_buffering" directive. * Bugfix: in the ngx_http_mp4_module. * Bugfix: nginx treated a comma as separator in the "Cookie" request header line when evaluating "$cookie_..." variables. * Bugfix: in IMAP command literal argument parsing. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.8 -> 12.0Gyorgy Sarvari2026-03-171-2/+2
| | | | | | | | | | | | | Changelog: * mbed TLS updated to 4.0.0. * Replaced strcpy() with strlcpy() and sprintf() with snprintf(). * Added OS sandbox. * Removed DHsize option. * Known bug: mbed TLS v4.0.0 doesn't compile in Cygwin, so building a Windows package is not possible. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.29.1 -> 1.29.5Gyorgy Sarvari2026-02-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: copyright year bump. Changelog: 1.29.5: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream. - Bugfix: a response with multiple ranges might be larger than the source response. - Bugfix: fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends. - Bugfix: fixed warning when compiling with MSVC 2022 x86. - Change: the logging level of the "ech_required" SSL error has been lowered from "crit" to "info". 1.29.4: - Feature: the ngx_http_proxy_module supports HTTP/2. - Feature: Encrypted ClientHello TLS extension support when using OpenSSL ECH feature branch; the "ssl_ech_file" directive. Thanks to Stephen Farrell. - Change: validation of host and port in the request line, "Host" header field, and ":authority" pseudo-header field has been changed to follow RFC 3986. - Change: now a single LF used as a line terminator in a chunked request or response body is considered an error. - Bugfix: when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation fault might occur in a worker process; the bug had appeared in 1.29.1. Thanks to Jan Svojanovsky. - Bugfix: a segmentation fault might occur in a worker process if the "try_files" directive and "proxy_pass" with a URI were used. 1.29.3: - Feature: the "add_header_inherit" and "add_trailer_inherit" directives. - Feature: the $request_port and $is_request_port variables. - Feature: the $ssl_sigalg and $ssl_client_sigalg variables. - Feature: the "volatile" parameter of the "geo" directive. - Feature: now certificate compression is available with BoringSSL. - Bugfix: now certificate compression is disabled with OCSP stapling. 1.29.2 - Feature: now nginx can be built with AWS-LC. Thanks Samuel Chiang. - Bugfix: now the "ssl_protocols" directive works in a virtual server different from the default server when using OpenSSL 1.1.1 or newer. - Bugfix: SSL handshake always failed when using TLSv1.3 with OpenSSL and client certificates and resuming a session with a different SNI value; the bug had appeared in 1.27.4. - Bugfix: the "ignoring stale global SSL error" alerts might appear in logs when using QUIC and the "ssl_reject_handshake" directive; the bug had appeared in 1.29.0. Thanks to Vladimir Homutov. - Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. - Bugfix: an XCLIENT command didn't use the xtext encoding. Thanks to Igor Morgenstern of Aisle Research. - Bugfix: in SSL certificate caching during reconfiguration. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.28.1 -> 1.28.2Gyorgy Sarvari2026-02-161-1/+1
| | | | | | | | | | | | Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.7 -> 11.8Gyorgy Sarvari2026-02-044-122/+1
| | | | | | | | | | | Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: ignore CVE-2025-53859 for 1.28.1Peter Marko2026-01-121-0/+2
| | | | | | | | | Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: set CVE_PRODUCTGyorgy Sarvari2026-01-041-0/+2
| | | | | | | | | nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.28.0 -> 1.28.1Jason Schonberg2026-01-043-138/+5
| | | | | | | | | | | | | Drop CVE patch which has been integrated into this new version. Solves: * CVE-2025-53859 CHANGES: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.65 -> 2.4.66Valeria Petrov2025-12-051-1/+1
| | | | | | | | | | | | | | Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: switch to libpcre2Hongxu Jia2025-12-011-1/+1
| | | | | | | | | NGINX 1.22 and later supports PCRE2 [1] [1] https://github.com/nginx/nginx/commit/c6fec0b027569a4e0b1d8aaee7dea0f2e4d6052b Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-051-0/+1
| | | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Fix bundled mbedtls with clang-21Khem Raj2025-08-294-1/+123
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: patch CVE-2025-53859 in stablePeter Marko2025-08-252-0/+132
| | | | | | | | | Pick patch from nginx site which is also mentioned in [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade mainline 1.27.4 -> 1.29.1Peter Marko2025-08-252-10/+10
| | | | | | | Solves CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade stable 1.26.3 -> 1.28.0Peter Marko2025-08-252-6/+6
| | | | | | | | | | | | | | | | | | 2025-04-23 nginx-1.28.0 stable version has been released, incorporating new features and bug fixes from the 1.27.x mainline branch - including memory usage and CPU usage optimizations in complex SSL configurations, automatic re‑resolution of hostnames in upstream groups, performance enhancements in QUIC, OCSP validation of client SSL certificates and OCSP stapling support in the stream module, variables support in the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate, and uwsgi_limit_rate directives, the proxy_pass_trailers directive, and more. License-Update: copyright years refreshed and removed C-style comments Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.64 -> 2.4.65Wang Mingyu2025-07-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.63 -> 2.4.64Wang Mingyu2025-07-151-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Upgrade to 11.7Khem Raj2025-07-121-4/+12
| | | | | | | Enable TLS support Fix build with cmake4+ Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Upgrade to 1.8.4Khem Raj2025-07-123-23/+47
| | | | | | Use default cmake backend ( ninja ) Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-openembedded/all: adapt to UNPACKDIR changesAlexander Kanavin2025-06-255-5/+1
| | | | | | | | | | | | | Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: use -std=gnu17 for compilationYoann Congal2025-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | hiawatha does not build under -std=gnu23 which is the default of gcc15. Forcing -std=gnu17 fixes these build errors: | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:814:25: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types] | 814 | signal(SIGHUP, HUP_handler); | | ^~~~~~~~~~~ | | | | | void (*)(void) | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:88:57: note: expected '__sighandler_t' {aka 'void (*)(int)'} but argument is of type 'void (*)(void)' | 88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler) | | ~~~~~~~~~~~~~~~^~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:294:6: note: 'HUP_handler' declared here | 294 | void HUP_handler() { | | ^~~~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:72:16: note: '__sighandler_t' declared here | 72 | typedef void (*__sighandler_t) (int); | | ^~~~~~~~~~~~~~ Note: Upstream project has no published way to upstream patches. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: update HOMEPAGEYoann Congal2025-05-081-1/+1
| | | | | | | | | As noted in 11.7 changelog: https://hiawatha.leisink.net/changelog > All references to http://www.hiawatha-webserver.org/ changed to > https://hiawatha.leisink.net/. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Scrub -ffile-prefix-map in build.nice fileKhem Raj2025-04-221-1/+1
| | | | | | | Fixes QA Issue: File /usr/libexec/apache2/build/config.nice in package apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Update project websiteJason Schonberg2025-04-161-1/+1
| | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.1 -> 11.2Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.2.1. Small improvements. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.0 -> 11.1Jason Schonberg2025-03-201-1/+1
| | | | | | | | | | Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.1.0. Small bugfixes. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* sthttpd: Fix service unit fileAlexis Cellier2025-02-271-2/+2
| | | | | | | | | | | Update PID file path from /var/run to /run to avoid systemd warning: PIDFile= references a path below legacy directory /var/run/, updating /var/run/thttpd.pid → /run/thttpd.pid; please update the unit file accordingly. Cc: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.27.3 to 1.27.4Changqing Li2025-02-161-2/+2
| | | | | | | | | | | | | License-Update: copyright year refreshed Resolves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.26.2 to 1.26.3Changqing Li2025-02-161-1/+1
| | | | | | | | | | | Solves: * CVE-2025-23419 CHANGES: https://nginx.org/en/CHANGES-1.26 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.62 -> 2.4.63Wang Mingyu2025-02-101-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mod-dnssd: update SRC_URIGyorgy Sarvari2025-02-031-1/+1
| | | | | | | | | Upstream repository url changed. Fixes unsuccessful fetch warning. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 10.12 -> 11.0Jason Schonberg2025-01-241-3/+2
| | | | | | | | | | | | | | The https://www.hiawatha-webserver.org/ site is defunct. So move SRC_URI to use https://hiawatha.leisink.net/ instead. Update to 11.0 while we are here. Changelog: https://hiawatha.leisink.net/changelog mbed TLS updated to 3.0.0. Dropped support for TLSv1.0 and TLSv1.1. Configuration option MinTLSversion removed. Dropped support for HTTP Public Key Pinning (HPKP). Configuration option PublicKeyPins removed. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-1237Peter Marko2024-12-241-0/+1
| | | | | | | | | | | | | | | This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore disputed CVE CVE-2007-0086Peter Marko2024-12-191-0/+1
| | | | | | | | | | | | | | | | This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: ignore CVE-2013-1771Peter Marko2024-12-191-0/+1
| | | | | | | | This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: remove old version references from CVEsPeter Marko2024-12-191-7/+7
| | | | | | | | These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-0678 and CVE-1999-1412Peter Marko2024-12-191-0/+2
| | | | | | | These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline release version 1.27.1 -> 1.27.3Derek Straka2024-12-101-2/+2
| | | | | | | License-Update: License file negative and empty space changes Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: do not depend on zlib header and libs from hostValeria Petrov2024-10-091-1/+1
| | | | | | | | | | | | | | | | | This commit modifies the PACKAGECONFIG entry for zlib to ensure that the mod_deflate module is enabled with the appropriate zlib configuration. By adding the --with-zlib=${STAGING_LIBDIR}/../ option, we direct the configure script to use the zlib library from the staging directory instead of relying on the host system's zlib installation. Without that configure will search the host for zlib headers and lib. This change resolves build failures related to zlib dependency when mod_deflate is enabled and ensures a consistent build environment across different host configurations. Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cherokee: Remove obsolete recipeNiko Mauno2024-09-307-267/+0
| | | | | | | | | | | | | | | | | | | | This recipe depends on meta-python2, master branch of which has not been updated sine February 2022, see https://git.openembedded.org/meta-python2/log/?h=master Also, https://cherokee-project.com/doc/basics_requirements.html states The main Python releases targeted by our developers are 2.4, 2.5 and 2.6. Anything other than that is not guaranteed to work at the moment. Also, master branch of cherokee has not been updated since January 2023, see https://github.com/cherokee/webserver/commits/master/ Thus, remove the obsolete recipe and the associated packagegroup reference. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-16 21:50:27 +0000