From mboxrd@z Thu Jan 1 00:00:00 1970 From: git@ipfire.org To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. b76d0433be26c005f159aebf1fb19c579e8bd329 Date: Wed, 20 Sep 2017 22:12:57 +0100 Message-ID: <20170920211257.7A6AD1081DE1@git01.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0618676595119968155==" List-Id: --===============0618676595119968155== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b76d0433be26c005f159aebf1fb19c579e8bd329 (commit) via fdff464161be76c8361919f1bd546a66ce6c889d (commit) from 77090f6d13263ee4810d34a8bca5b01f97f5f9b1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b76d0433be26c005f159aebf1fb19c579e8bd329 Author: Matthias Fischer Date: Wed Sep 20 11:08:52 2017 +0200 apache2: Import patch for CVE-2017-9798 ("optionsbleed") =20 Imported from: https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1= =3D1805223&r2=3D1807754&pathrev=3D1807754&view=3Dpatch =20 For details see: https://nvd.nist.gov/vuln/detail/CVE-2017-9798 =20 Best, Matthias =20 Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit fdff464161be76c8361919f1bd546a66ce6c889d Author: Matthias Fischer Date: Tue Sep 19 08:10:12 2017 +0200 unbound: Update to 1.6.6 =20 For details see: http://www.unbound.net/download.html =20 Best, Matthias =20 Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/unbound | 2 +- lfs/apache2 | 2 +- lfs/unbound | 4 ++-- src/patches/apache-2.4.27-CVE-2017-9798-fix.patch | 15 +++++++++++++++ 4 files changed, 19 insertions(+), 4 deletions(-) create mode 100644 src/patches/apache-2.4.27-CVE-2017-9798-fix.patch Difference in files: diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index b029c8b..6d153f2 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.2 -usr/lib/libunbound.so.2.5.4 +usr/lib/libunbound.so.2.5.5 usr/sbin/unbound usr/sbin/unbound-anchor usr/sbin/unbound-checkconf diff --git a/lfs/apache2 b/lfs/apache2 index e434d1b..b7a7416 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -76,7 +76,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/apache-2.4.27-PR61382= -fix.patch - + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/apache-2.4.27-CVE-201= 7-9798-fix.patch ### Add IPFire's layout, too echo "# IPFire layout" >> $(DIR_APP)/config.layout echo "" >> $(DIR_APP)/config.layout diff --git a/lfs/unbound b/lfs/unbound index 4625284..39ad0de 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ =20 include Config =20 -VER =3D 1.6.5 +VER =3D 1.6.6 =20 THISAPP =3D unbound-$(VER) DL_FILE =3D $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects =3D $(DL_FILE) =20 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) =20 -$(DL_FILE)_MD5 =3D 5825332b72bae9d8793f9cba16cb13fd +$(DL_FILE)_MD5 =3D f2cc56bd88c9634fe18334d2421205f1 =20 install : $(TARGET) =20 diff --git a/src/patches/apache-2.4.27-CVE-2017-9798-fix.patch b/src/patches/= apache-2.4.27-CVE-2017-9798-fix.patch new file mode 100644 index 0000000..eb82c8b --- /dev/null +++ b/src/patches/apache-2.4.27-CVE-2017-9798-fix.patch @@ -0,0 +1,15 @@ +--- server/core.c 2017/08/16 16:50:29 1805223 ++++ server/core.c 2017/09/08 13:13:11 1807754 +@@ -2262,6 +2262,12 @@ + /* method has not been registered yet, but resource restriction + * is always checked before method handling, so register it. + */ ++ if (cmd->pool =3D=3D cmd->temp_pool) { ++ /* In .htaccess, we can't globally register new methods. */ ++ return apr_psprintf(cmd->pool, "Could not register method '= %s' " ++ "for %s from .htaccess configuration", ++ method, cmd->cmd->name); ++ } + methnum =3D ap_method_register(cmd->pool, + apr_pstrdup(cmd->pool, method)); + } hooks/post-receive -- IPFire 2.x development tree --===============0618676595119968155==--