summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* netdata: ignore CVE-2024-32019Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32019 The vulnerability affects the ndsudo binary, part of netdata. This binary was introduced in version 1.45.0[1], and the recipe contains v1.34.1 - which is not vulnerable yet. Ignore the CVE due to this. [1]: https://github.com/netdata/netdata/commit/0c8b46cbfd05109a45ee4de27f034567569fa3fa Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* phpmyadmin: ignore CVE-2020-22452Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-22452 The fix is present in the recipe version (5.1.4)[1] [1]: https://github.com/phpmyadmin/phpmyadmin/pull/16004/commits/ca42395ee4b2936d3702524f8fb8bec1e9502bc7 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xdebug: upgrade 3.1.1 -> 3.1.5Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This update contains many bugfixes. Changelog: https://xdebug.org/updates#x_3_1_5 3.1.5: - Install documentation gives wrong arch for installation on M1 Macs - phpize --clean removes required clocks.m4 file - Constant defined with an enum case produce double "facet" attribute in context_get response - Crash when used with source guardian encoded files - Segfault in __callStatic() after FFI initialization 3.1.4: - Removing second call breakpoint with same function name - XDebug breaks the Symfony "PhpFilesAdapter" cache adapter - Possible use after free with GC Stats - Can't inspect ArrayObject storage elements - Segmentation fault in symfony cache - Debug session can be started with "XDEBUG_SESSION_START=anything" when xdebug.trigger_value is set - Warn when profiler_append is used together with zlib compression - Code coverage misses static array assignment lines 3.1.3: - evaling broken code (still) causes unhandled exception in PHP 7.4 - Memory leak when a trace file can't be opened because xdebug.trace_output_name is invalid - Slowdown when calling a function with long string parameters - Debugger creates XML with double facet attribute 3.1.2: - Segfault on fiber switch in finally block in garbage collected fiber - Crash when profile file can not be created - __debugInfo is not used for var_dump output - Segault on xdebug_get_function_stack inside a Fiber Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* phpmyadmin: upgrade 5.1.3 -> 5.1.4Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Last bugfix release of the 5.1.x series. Changelog: - Fixed sorting the database list with "statistics" enabled on "Data" column creates a PHP type error - Fix for invalid cache when losing access to config storage after it being cached - Fix session cookie not respecting the CookieSameSite configuration directive in PHP 7.2 - Fix create index form accepting too many columns - Disable editing to system schemas - Add better error handling when IndexedDB is not working - Fixed incorrect escaping of special MySQL characters on some pages - Fix GIS visualization with an edited query - Remove the use of the deprecated `strftime` function in OpenDocument exports - Enable tabindex recompute on preview button while insert new rows - Fix invalid SQL generated when PRIMARY/UNIQUE key contains a POINT column - Fix setup's CSS not loading when the URL doesn't have a trailing slash - Remove jQuery SVG JavaScript dependency - Fix column visibility dropdown when the column name is too long - Fix issue when exporting using Firefox or Safari on PHP 8.1.4 - Update JavaScript dependencies - Fix case where errors were thrown when browsing a table - Fix UI issue when user accounts page has the initials navigation bar Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* hiawatha: set a working SRC_URIGyorgy Sarvari2025-12-221-1/+1
| | | | | | The project has moved to a new site, old SRC_URI stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cherokee: patch CVE-2020-12845Gyorgy Sarvari2025-12-222-0/+196
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-12845 Pick the merge commit that mentions the vulnerability. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: upgrade 2.4.65 -> 2.4.66Valeria Petrov2025-12-121-1/+1
| | | | | | | | | | | | | | | Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cockpit: set correct CVE_PRODUCTGyorgy Sarvari2025-11-301-0/+2
| | | | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit af4df551eec582844a8b56154117915ace1596cd)
* monkey: ignore CVE-2013-1771Peter Marko2025-11-301-0/+2
| | | | | | | | | | | | | This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 36a7e409d8dcee804f911174291a0c72b8037934) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* monkey: Update status for CVE-2013-2183Ninette Adhikari2025-11-301-0/+2
| | | | | | | | | | | | Current version (1.6.9) is not affected. Issue was addressed in version 1.3.0 Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 17bcf478a512c7d75baa3b68e8f650aff7d17bbe) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-171-0/+2
| | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2022-0829Gyorgy Sarvari2025-10-172-0/+26
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-0829 Pick the patch from the nvd report details. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2022-0824Gyorgy Sarvari2025-10-172-0/+28
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-0824 Pick the patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2019-15642Gyorgy Sarvari2025-10-172-0/+27
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-15642 Pick the patch mentioned in the nvm report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2017-17089Gyorgy Sarvari2025-10-172-0/+30
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2017-17089 Pick the patch referenced in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2017-15644, CVE-2017-15645 and CVE-2017-15646Gyorgy Sarvari2025-10-172-1/+55
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2017-15644 https://nvd.nist.gov/vuln/detail/CVE-2017-15645 https://nvd.nist.gov/vuln/detail/CVE-2017-15646 Pick the patch mentioned in the nvd report (same patch is marked to fix all three vulnerabilities). Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: ignore irrelevant CVEsGyorgy Sarvari2025-10-121-0/+19
| | | | | | | | | | | | | | | | Ignore a number of CVEs for this recipe (because they are for another software, outdated version, or because they affect only non-Linux platforms). This commit is a backport of a number of commits from the master branch (which uses the same version of the recipe): 0e7733f1b8f51949ec91d82267d5d864ac0be16a 1b86a60f6283b08acadc50914075d93dd362700b 59d3949e3ed673bd049aadfd2238213b550f1461 1b86a60f6283b08acadc50914075d93dd362700b da2b5e8b93c248363581b1bd4ff67ff1d8357c41 0e7733f1b8f51949ec91d82267d5d864ac0be16a Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* readme: update maintainerGyorgy Sarvari2025-09-181-1/+1
| | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* readme: update maintainerGyorgy Sarvari2025-09-161-1/+1
| | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: upgrade 2.4.62 -> 2.4.65Archana Polampalli2025-09-061-1/+1
| | | | | | | | | | | | This upgrade incorporates the fixes for CVE-2025-53020, CVE-2025-49812, CVE-2025-49630, CVE-2025-23048, CVE-2024-47252, CVE-2024-43394, CVE-2024-43204, CVE-2024-42516, CVE-2025-54090 and other bugfixes. Changelog: https://www.apachelounge.com/Changelog-2.4.html Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nginx: patch CVE-2025-53859 in stablePeter Marko2025-09-062-0/+132
| | | | | | | | | Pick patch from nginx site which is also mentioned in [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fcgi: patch CVE-2025-23016Peter Marko2025-09-062-0/+41
| | | | | | | Pick commit referencing this CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nginx: fix CVE-2025-23419Changqing Li2025-03-062-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-23419 This partially cherry picked from commit 13935cf9fdc3c8d8278c70716417d3b71c36140e, the original patch had 2 parts. One fixed problem in `http/ngx_http_request` module and the second fixed problem in `stream/ngx_stream_ssl_module` module. The fix for `stream/ngx_stream_ssl_module can't be aplied because, the 'stream virtual servers' funcionality was added later in this commit: https://github.com/nginx/nginx/commit/d21675228a0ba8d4331e05c60660228a5d3326de. Therefore only `http/ngx_http_request` part was backported. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: fix CVE-2025-24529/CVE-2025-24530Changqing Li2025-02-093-1/+81
| | | | | | | | | | | | | | | | CVE-2025-24529: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24529 CVE-2025-24530: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24530 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Upgrade 2.4.60 -> 2.4.62Archana Polampalli2024-12-081-1/+1
| | | | | | | | | | | | | CVE's Fixed by upgrade: CVE-2024-39884 CVE-2024-40725 Other Changes between 2.4.60 -> 2.4.62 ====================================== https://github.com/apache/httpd/blob/2.4.62/CHANGES Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: Backport fix for CVE-2024-7347Ashish Sharma2024-08-253-0/+88
| | | | | | | | Upstream-Status: Backport [https://github.com/nginx/nginx/commit/88955b1044ef38315b77ad1a509d63631a790a0f & https://github.com/nginx/nginx/commit/7362d01658b61184108c21278443910da68f93b4] Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx-1.20.1: Drop reference to removed patchJasper Orschulko2024-07-171-1/+0
| | | | | | | | | | Follow-up to commits 38a07ce and 8e297cd. Also remove remaining reference to removed patch in nginx 1.20.1. Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Upgrade 2.4.59 -> 2.4.60Siddharth Doshi2024-07-171-1/+1
| | | | | | | | | | | | | | | | | | | CVE's Fixed by upgrade: CVE-2024-36387 apache2/httpd: DoS by null pointer in websocket over HTTP/2 CVE-2024-38472 apache2/httpd: UNC SSRF on WIndows CVE-2024-38473 apache2/httpd: Encoding problem in mod_proxy CVE-2024-38474 apache2/httpd: Substitution encoding issue in mod_rewrite CVE-2024-38475 apache2/httpd: Improper escaping of output in mod_rewrite CVE-2024-38476 apache2/httpd: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2024-38477 apache2/httpd: null pointer dereference in mod_proxy CVE-2024-39573 apache2/httpd: Potential SSRF in mod_rewrite Other Changes between 2.4.59 -> 2.4.60 ====================================== https://github.com/apache/httpd/blob/2.4.60/CHANGES Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx-1.21.1: Drop reference to removed patchNiko Mauno2024-06-271-2/+0
| | | | | | | | | | | | Align to commit 8e297cdc841c6cad34097f00a6903ba25edfc153 ("nginx: Remove obsolete patch") by removing reference to removed patch file. By doing so we mitigate the following BitBake complaint: WARNING: .../meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.21.1.bb: Unable to get checksum for nginx SRC_URI entry 0001-HTTP-2-per-iteration-stream-handling-limit.patch: file could not be found Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: Remove obsolete patchJasper Orschulko2024-06-021-92/+0
| | | | | | | | | | With the inclusion of commit 85102dd2dff41945997b983f7c2bfc954dd3bc47 the same patch was introduced again, thus this copy can be deleted (which accidently was never used, since I originally forgot to add it to the SRC_URI, whoops). Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: fix CVE-2023-44487Meenali Gupta2024-05-262-0/+80
| | | | | | | | | | | | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. References: https://nvd.nist.gov/vuln/detail/CVE-2023-44487 Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Upgrade v2.4.58 -> v2.4.59Soumya Sambu2024-04-283-14/+14
| | | | | | | | | | | | | | | This upgrade incorporates the fixes for CVE-2024-27316, CVE-2024-24795,CVE-2023-38709 and other bugfixes. Adjusted 0004-apache2-log-the-SELinux-context-at-startup.patch and 0007-apache2-allow-to-disable-selinux-support.patch to align with upgraded version. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.59 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.57 -> 2.4.58Narpat Mali2024-01-122-33/+1
| | | | | | | | | | | | | | | | | | | | This upgrade incorporates the CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802 fixes and other bugfixes. The "0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch" is no longer needed as it's included in this upgrade. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.58 References: https://httpd.apache.org/security/vulnerabilities_24.html https://security-tracker.debian.org/tracker/CVE-2023-31122 https://security-tracker.debian.org/tracker/CVE-2023-43622 https://security-tracker.debian.org/tracker/CVE-2023-45802 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: add vendor to product name used for CVE checkingJeffrey Pautler2024-01-121-1/+1
| | | | | | | | | | | | | | This recipe sets the product name used for CVE checking to "http_server". However, the cve-check logic matches that name to all products in the CVE database regardless of vendor. Currently, it is matching to products from vendors other than apache. As a result, CVE checking incorrectly reports CVEs for those vendors' products for this package. Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 51f70eaaa5973e385645f574093ee860f5648f88) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: Mitigate HTTP/2 Stream Resets Flood impactJasper Orschulko2023-12-133-0/+95
| | | | | | | | | | | | | | | | Reduces the impact of HTTP/2 Stream Reset flooding in the nginx product (CVE-2023-44487). See: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ This patch only reduces the impact and does not completely mitigate the CVE in question, the latter being due to a design flaw in the HTTP/2 protocol itself. For transparancy reasons I therefore opted to not mark the CVE as resolved, so that integrators can decide for themselves, wheither to enable HTTP/2 support or allow HTTP/1.1 connections only. Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: upgrade to 1.24.0 releaseMichael Haener2023-11-181-0/+6
| | | | | | | | | | According to http://nginx.org/en/CHANGES nginx supports the openssl 3.x component only from version 1.21.2. In Kirstone openssl 3.x is included but all provided versions of nginx are older, so there is currently an incompatibility. With this patch this incompatibility get removed. Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: add configure optionJoe Slater2023-10-172-0/+42
| | | | | | | | | | Support --with-http_xslt_module configure option via a PACKAGECONFIG option. The option is not added to the defaults. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e0ac8eec48ddddc93751cfcdef2557998bfe91c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* webserver: nginx: Add streamLuke Schaefer2023-07-041-0/+1
| | | | | | | | Signed-off-by: Luke Schaefer <lukeschafer17@gmail.com> Add stream support to nginx PACKAGECONFIG Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.56 -> 2.4.57Valeria Petrov2023-05-062-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: Changes with Apache 2.4.57 *) mod_proxy: Check before forwarding that a nocanon path has not been rewritten with spaces during processing. [Yann Ylavic] *) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not double encode encoded slashes in the URL sent by the reverse proxy to the backend. [Ruediger Pluem] *) mod_http2: fixed a crash during connection termination. See PR 66539. [Stefan Eissing] *) mod_rewrite: Fix a 2.4.56 regression for substitutions ending in a question mark. PR66547. [Eric Covener] *) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded characters on redirections without the "NE" flag. [Yann Ylavic, Eric Covener] *) mod_proxy: Fix double encoding of the uri-path of the request forwarded to the origin server, when using mapping=encoded|servlet. [Yann Ylavic] *) mod_mime: Do not match the extention against possible query string parameters in case ProxyPass was used with the nocanon option. [Ruediger Pluem] New patch: 0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch Accepted in upstream, expected to be removed at next apache2 2.4.58 update. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0b9305faa29f6e26871e7662391efbaae4ae92d9) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: fix CVE-2023-25727Dragos-Marian Panait2023-04-042-0/+38
| | | | | | | | | | | | | | | | In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-25727 Upstream patch: https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com> Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* monkey: use git fetcherMartin Jansa2023-03-291-2/+3
| | | | | | | | | | | | * monkey-project.com doesn't resolve anymore * use v1.6.9 tag from github Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d04444509a220fcb61496d7e64f3ba09c647543b) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 16c5d44d421a10510e7d31f9368df5a9560ddd05) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* monkey: Fix build with muslKhem Raj2023-03-292-0/+31
| | | | | | Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8f44a8894f1e24cc7c59250e5dd07e1cc420430a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.55 -> 2.4.56Wang Mingyu2023-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - rotatelogs: Add -T flag to allow subsequent rotated logfiles to be truncated without the initial logfile being truncated. - mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to allow connections of any age to be reused. Up to now, a negative value was handled as an error when parsing the configuration file. PR 66421. - mod_proxy_ajp: Report an error if the AJP backend sends an invalid number of headers. - mod_md: - Enabling ED25519 support and certificate transparency information when building with libressl v3.5.0 and newer. - MDChallengeDns01 can now be configured for individual domains. - Fixed a bug that caused the challenge teardown not being invoked as it should. - mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors reported in access logs and error documents. The processing of the reset was correct, only unneccesary reporting was caused. - mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f8b54b5243c9effb66d5685463b87767e753b843) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: use /run instead of /var/run for systemd volatile configYi Zhao2023-03-161-1/+1
| | | | | | | | | | | | Fixes: systemd-tmpfiles[181]: /etc/tmpfiles.d/apache2-volatile.conf:1: Line references path below legacy directory /var/run/, updating /var/run/apache2 -> /run/apache2; please update the tmpfiles.d/ drop-in file accordingly. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f018a6bb3b8400a19cd35b76809edcd545975465) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.54 -> 2.4.55Wang Mingyu2023-02-111-1/+1
| | | | | | | | | | | | Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.55 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cba6df61c7cbc4446aab09eb11673bcb6c581307) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 02c53492ea4085ba13ff73063d6f9144dad5a627) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: CVE-2022-41741, CVE-2022-41742 Memory corruption in the ↵Hitendra Prajapati2022-11-192-1/+322
| | | | | | | | | ngx_http_mp4_module Upstream-Status: Backport from https://github.com/nginx/nginx/commit/6b022a5556af22b6e18532e547a6ae46b0d8c6ea Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Fix the buildpaths issueMingli Yu2022-08-072-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: WARNING: apache2-2.4.54-r0 do_package_qa: QA Issue: File /usr/src/debug/apache2/2.4.54-r0/build/server/exports.c in package apache2-src contains reference to TMPDIR [buildpaths] Before the patch: # cat ./build/server/exports.c [snip] #include "mpm_fdqueue.h" const void *ap_ugly_hack = NULL; /* * /buildarea/build/tmp-glibc/work/core2-32-wrs-linux/apache2/2.4.54-r0/httpd-2.4.54/include/ap_expr.h */ const void *ap_hack_ap_expr_exec = (const void *)ap_expr_exec; [snip] After the patch: # cat ./build/server/exports.c [snip] #include "mpm_fdqueue.h" const void *ap_ugly_hack = NULL; /* * ap_expr.h */ const void *ap_hack_ap_expr_exec = (const void *)ap_expr_exec; [snip] Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4f2025e8d2f1626e97f7e9e675ce3c7d45477807) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.53 -> 2.4.54Changqing Li2022-07-182-5/+5
| | | | | | | | | | | | | | This upgrade include CVE fixes: CVE-2022-30522 CVE-2022-31813 CVE-2022-28615 CVE-2022-30556 CVE-2022-29404 CVE-2022-26377 CVE-2022-28614 CVE-2022-28330 Signed-off-by: Changqing Li <changqing.li@windriver.com>
* meta-openemnedded: Add myself as kirkstone maintainerArmin Kuster2022-04-231-4/+7
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: version bump 1.33.1 -> 1.34.1Jan Vermaete2022-04-211-1/+1
| | | | | Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 19:40:22 +0000