[PATCH] apache: Update to 2.4.71

[Matthias Fischer <matthias.fischer@ipfire.org>]

For details see:
https://dlcdn.apache.org/httpd/CHANGES_2.4.71

"Changes with Apache 2.4.71

  *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in
     assign_headers (cve.mitre.org)
     Concurrent Execution using Shared Resource with Improper
     Synchronization vulnerability in Apache HTTP Server's mod_http2
     in assign_headers() can lead to RCE.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.70.
     Affected releases of mod_h2 from GitHub: from 2.0.8 through
     2.0.42.
     Credits: Anthropic's OSS Scanner, as vulnerability
     ANT-2026-MAPKT6MZ

  *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer
     overwrite (after CVE-2026-63292) (cve.mitre.org)
     Stack-based buffer overflow vulnerability in Apache HTTP
     Server's mod_vhost_alias (after CVE-2026-63292)
     This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.
     Credits: Gustavo Aiello

  *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads
     to child process crash (cve.mitre.org)
     NULL pointer dereference vulnerability in Apache HTTP Server's
     mod_md during HTTP request processing.
     This issue affects Apache HTTP Server: from 2.4.30 through
     2.4.70.
     Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability
     Research Institute, working with 360 TuLongFeng.

  *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain.
     New directive MDHttpProxyCACertificateFile sets the CA certificates
     used to verify an HTTPS proxy.
     [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a
     length byte with the high bit set is no longer sign-extended, fixing
     inflation of gzip streams that carry an extra field.
     [arshiya tabasum <arshi bugqore.com>]

  *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host
     they are configured in, and merge the proxy entries of the main server
     and of the virtual host, logging a warning when both have some.
     PR 70207.  [Arturo Bernal]

  *) mod_dav: Fix handling of invalid or overflowing "Timeout:"
     request headers, which could silently grant a lock with an
     already-expired timeout instead of the RFC 4918 maximum.
     PR 65788 [Arturo Bernal]

  *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests
     instead of rejecting them as malformed.  PR 70195.
     [Arturo Bernal <abernal apache.org>]

  *) mod_http2: Fix duplicate logging of header limit violations.
     [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_http2: Fix a crash creating an HTTP/2 session with
     "H2PushDiarySize 0" and debug logging enabled.  [Joe Orton]

  *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the
     indirect-lock key length with the wrong width, which could read
     back a wrong length on big-endian platforms. PR 70299
     [Arturo Bernal]

  *) mod_remoteip: Log a connection closed before a complete PROXY protocol
     header was received at info level rather than as an error.  PR 63893.
     [Joe Orton]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
 config/rootfiles/common/apache2 | 9 +++++++++
 lfs/apache2                     | 4 ++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2
index 9206fcffd..0a8aac7a9 100644
--- a/config/rootfiles/common/apache2
+++ b/config/rootfiles/common/apache2
@@ -498,6 +498,7 @@ srv/web/ipfire/html/captive
 #srv/web/ipfire/manual/howto/ssi.html.ja.utf8
 #srv/web/ipfire/manual/howto/ssi.html.ko.euc-kr
 #srv/web/ipfire/manual/images
+#srv/web/ipfire/manual/images/README.md
 #srv/web/ipfire/manual/images/apache_header.gif
 #srv/web/ipfire/manual/images/bal-man-b.png
 #srv/web/ipfire/manual/images/bal-man-w.png
@@ -534,8 +535,16 @@ srv/web/ipfire/html/captive
 #srv/web/ipfire/manual/images/reverse-proxy-arch.png
 #srv/web/ipfire/manual/images/rewrite_backreferences.png
 #srv/web/ipfire/manual/images/rewrite_backreferences.svg
+#srv/web/ipfire/manual/images/rewrite_l_flag_looping.png
+#srv/web/ipfire/manual/images/rewrite_l_flag_looping.svg
+#srv/web/ipfire/manual/images/rewrite_module_order.png
+#srv/web/ipfire/manual/images/rewrite_module_order.svg
+#srv/web/ipfire/manual/images/rewrite_path_stripping.png
+#srv/web/ipfire/manual/images/rewrite_path_stripping.svg
 #srv/web/ipfire/manual/images/rewrite_process_uri.png
 #srv/web/ipfire/manual/images/rewrite_process_uri.svg
+#srv/web/ipfire/manual/images/rewrite_simplified_overview.png
+#srv/web/ipfire/manual/images/rewrite_simplified_overview.svg
 #srv/web/ipfire/manual/images/right.gif
 #srv/web/ipfire/manual/images/ssl_intro_fig1.gif
 #srv/web/ipfire/manual/images/ssl_intro_fig1.png
diff --git a/lfs/apache2 b/lfs/apache2
index 3f9759d10..dbd5863b7 100644
--- a/lfs/apache2
+++ b/lfs/apache2
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 2.4.68
+VER        = 2.4.71
 
 THISAPP    = httpd-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5c2d4b21915db3ca62ee374e89bb04dcec21a6f2f1334f6306db079de03a974709ef71f3728c56e020c844e331b800306fcf5a865dcd2e02576d41ae6cac6b70
+$(DL_FILE)_BLAKE2 = 9c5d780fee12a6ce993c337bfbc4ea37128348beb90e87d4614a4b7588b5917b31e618785c35cae4768ecc1451039fe47bd17b421fff2d4b4e3f6a9ac096b8af
 
 install : $(TARGET)
 
-- 
2.53.0