From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH] apache: Update to 2.4.61 Date: Fri, 05 Jul 2024 17:36:40 +0200 Message-ID: <20240705153640.3437810-1-matthias.fischer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8359372785018950675==" List-Id: --===============8359372785018950675== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.61 "Changes with Apache 2.4.61 *) SECURITY: CVE-2024-39884: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue." Signed-off-by: Matthias Fischer --- lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 2736eec8d..2dfd8b39d 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ =20 include Config =20 -VER =3D 2.4.60 +VER =3D 2.4.61 =20 THISAPP =3D httpd-$(VER) DL_FILE =3D $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects =3D $(DL_FILE) =20 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) =20 -$(DL_FILE)_BLAKE2 =3D d1b4d2e05edfe8b88f541e6fa8b5db73f37cc349a4037b493e57ae= 2f2e0bb84f92aad3ad3bc0bdbc454d2677091bbca283ebe752a9335fae6931ec65cc687326 +$(DL_FILE)_BLAKE2 =3D 9299ef5843888829143732b3a60d1713aff688ed2f6c2b7f154be1= 6bc075ec747a5b116716f188491ebc9947ff2dfe09dfc71f5245d98a4be3ba27ada28ec8a5 =20 install : $(TARGET) =20 --=20 2.34.1 --===============8359372785018950675==--