Commit Graph

9 Commits

Author SHA1 Message Date
Bernd Kuhls
68af1dc257 package/apache: security bump version to 2.4.25
Changelog:
http://www.apache.org/dist/httpd/CHANGES_2.4.25

Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736,
CVE-2016-8743.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-12-22 10:01:22 +01:00
Fabrice Fontaine
bc5584fc90 apache: add customization of MPM
MPM can be selected between event, prefork or worker
Set worker as the default one as it was before even if event MPM is
better on system supporting thread safe polling

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-09-12 23:13:44 +02:00
Bernd Kuhls
d72868f158 package/apache: security bump to version 2.4.23
Fixes CVE-2016-4979:
TLS/SSL X.509 client certificate auth bypass with HTTP/2
http://httpd.apache.org/security/vulnerabilities_24.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-07-07 11:48:49 +02:00
Gustavo Zacarias
07e4772115 apache: bump to version 2.4.20
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-04-13 21:36:43 +02:00
Thomas Petazzoni
22e63d952e apache, apr: fix atomic handling
Since the apache package was introduced,
--enable-nonportable-atomics=yes was passed when
BR2_ARCH_HAS_ATOMICS. However, Apache doesn't take this option: it
only passes it down when building the APR library. But since we're
building APR separately, this statement had no effect.

So this commit removes the useless code from the Apache package, and
instead adds the appropriate logic to the apr package, using the new
BR2_TOOLCHAIN_HAS_SYNC_x symbols rather than BR2_ARCH_HAS_ATOMICS.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
2016-02-06 11:16:00 +01:00
Bernd Kuhls
4e2af5eac4 package/apache: bump version to 2.4.18
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-19 14:06:32 +01:00
Vicente Olivert Riera
b87447a50f apache: bump to version 2.4.17
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-10-14 22:29:12 +02:00
Bernd Kuhls
fd9abf873a package/apache: security bump to version 2.4.16
Fixes CVE-2015-3183, CVE-2015-3185, CVE-2015-0253, CVE-2015-0228
http://marc.info/?l=apache-httpd-announce&m=143704705330655&w=2

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-16 23:39:44 +02:00
Bernd Kuhls
c0da6bcf85 apache: new package
[Thomas:
 - Don't explicitly pass CC_FOR_BUILD and CFLAGS_FOR_BUILD, those are
   already part of the default environment passed by the
   autotools-package infrastructure.
 - Explicitly disable Lua and LuaJIT support to avoid mis-detection of
   host installation.
 - Explicitly handle the optional support of libxml2, OpenSSL and
   zlib. Especially, the absence of explicit handling for libxml2 was
   causing a build failure due to the host libxml2 being detected.
 - Remove /usr/manual and /usr/build from the target. This saves 20+
   MB of target space.]

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-02-22 15:24:54 +01:00