kumquat-buildroot/package/apache/apache.hash

# From https://downloads.apache.org/httpd/httpd-2.4.52.tar.bz2.{sha256,sha512}
sha256  0127f7dc497e9983e9c51474bed75e45607f2f870a7675a86dc90af6d572f5c9  httpd-2.4.52.tar.bz2
sha512  97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6  httpd-2.4.52.tar.bz2
# Locally computed
sha256  47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43  LICENSE
package/apache: security bump to version 2.4.52 Fixes the following security issues: ) SECURITY: CVE-2021-44790: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier (cve.mitre.org) A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. Credits: Chamal ) SECURITY: CVE-2021-44224: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier (cve.mitre.org) A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). For more details, see the changes file: https://downloads.apache.org/httpd/CHANGES_2.4.52 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2021-12-22 18:42:45 +01:00			`# From https://downloads.apache.org/httpd/httpd-2.4.52.tar.bz2.{sha256,sha512}`
			`sha256 0127f7dc497e9983e9c51474bed75e45607f2f870a7675a86dc90af6d572f5c9 httpd-2.4.52.tar.bz2`
			`sha512 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6 httpd-2.4.52.tar.bz2`
package/apache: bump version to 2.4.34 Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.34 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2018-07-16 21:34:57 +02:00			`# Locally computed`
package/apache: security bump to version 2.4.43 Fixes the following security issues: ) SECURITY: CVE-2020-1934 (cve.mitre.org) mod_proxy_ftp: Use of uninitialized value with malicious backend FTP server. [Eric Covener] ) SECURITY: CVE-2020-1927 (cve.mitre.org) rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable matches and substitutions with encoded line break characters. The fix for CVE-2019-10098 was not effective. [Ruediger Pluem] The LICENSE file has been updated to fix a s/waranties/warranties/ typo, so update the hash to match and adjust the spacing to match recent agreements: -This software is provided "as is" and any express or implied waranties, +This software is provided "as is" and any express or implied warranties, Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2020-04-02 20:20:53 +02:00			`sha256 47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43 LICENSE`