From e9e214875fa9109ce49a31c5d964e31fccf02282 Mon Sep 17 00:00:00 2001 From: Mingli Yu Date: Mon, 29 Oct 2018 00:25:49 -0700 Subject: apache2: Fix CVE-2018-11763 mod_http2: connection IO event handling reworked. Instead of reacting on incoming bytes, the state machine now acts on incoming frames that are affecting it. This reduces state transitions. Reference: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-11763.html Signed-off-by: Mingli Yu Signed-off-by: Khem Raj --- meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb') diff --git a/meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb b/meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb index a3a6804d87..4cc3845463 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb @@ -10,6 +10,7 @@ inherit autotools pkgconfig native SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \ file://0001-configure-use-pkg-config-for-PCRE-detection.patch \ + file://CVE-2018-11763.patch \ " S = "${WORKDIR}/httpd-${PV}" -- cgit v1.2.3-54-g00ecf