-
apache2 (2.4.52-1ubuntu4.6) jammy; urgency=medium
* d/p/reenable-workers-in-standard-error-state-jammy-apache2.patch:
fix issue with workers in apache2 which could not recover from its
error state (LP: #2003189)
-- Michal Maloszewski <email address hidden> Wed, 03 May 2023 22:02:51 +0200
-
apache2 (2.4.52-1ubuntu4.5) jammy; urgency=medium
* d/p/mod_proxy_hcheck_jammy_fix_to_detect_support.patch: Fix issue
where enabling mod_proxy_hcheck results in error (LP: #1998311)
-- Michal Maloszewski <email address hidden> Wed, 01 Mar 2023 23:43:55 +0100
-
apache2 (2.4.52-1ubuntu4.4) jammy-security; urgency=medium
* SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
- debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
strings in modules/http2/mod_proxy_http2.c,
modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
modules/proxy/mod_proxy_wstunnel.c.
- debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
modules/http2/mod_proxy_http2.c.
- CVE-2023-25690
* SECURITY UPDATE: mod_proxy_uwsgi HTTP response splitting
- debian/patches/CVE-2023-27522.patch: stricter backend HTTP response
parsing/validation in modules/proxy/mod_proxy_uwsgi.c.
- CVE-2023-27522
-- Marc Deslauriers <email address hidden> Wed, 08 Mar 2023 12:32:01 -0500
-
apache2 (2.4.52-1ubuntu4.3) jammy-security; urgency=medium
* SECURITY UPDATE: DoS via crafted If header in mod_dav
- debian/patches/CVE-2006-20001.patch: fix error path for "Not" prefix
parsing in modules/dav/main/util.c.
- CVE-2006-20001
* SECURITY UPDATE: request smuggling in mod_proxy_ajp
- debian/patches/CVE-2022-36760.patch: cleanup on error in
modules/proxy/mod_proxy_ajp.c.
- CVE-2022-36760
* SECURITY UPDATE: response header truncation issue
- debian/patches/CVE-2022-37436.patch: fail on bad header in
modules/proxy/mod_proxy_http.c, server/protocol.c.
- CVE-2022-37436
-- Marc Deslauriers <email address hidden> Mon, 23 Jan 2023 13:34:42 -0500
-
apache2 (2.4.52-1ubuntu4.2) jammy; urgency=medium
* d/p/fix-a-possible-listener-deadlock.patch,
d/p/handle-children-killed-pathologically.patch: Fix situation
where Apache fails to start its child processes after a certain
number of requests, causing requests for new pages to hang.
(LP: #1988224)
* d/perl-framework/t/ssl/ocsp.t: Update test framework
- Cherry pick from Debian 2.4.53-1
-- Bryce Harrington <email address hidden> Thu, 29 Sep 2022 21:09:50 -0700
-
apache2 (2.4.52-1ubuntu4.1) jammy-security; urgency=medium
* SECURITY UPDATE: HTTP Request Smuggling
- debian/patches/CVE-2022-26377.patch: changing
precedence between T-E and C-L in modules/proxy/mod_proxy_ajp.c.
- CVE-2022-26377
* SECURITY UPDATE: Read beyond bounds
- debian/patches/CVE-2022-28614.patch: handle large
writes in ap_rputs.
in server/util.c.
- CVE-2022-28614
* SECURITY UPDATE: Read beyond bounds
- debian/patches/CVE-2022-28615.patch: fix types
in server/util.c.
- CVE-2022-28615
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2022-29404.patch: cast first
in modules/lua/lua_request.c.
- CVE-2022-29404
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2022-30522.patch: limit mod_sed
memory use in modules/filters/mod_sec.c,
modules/filters/sed1.c.
- CVE-2022-30522
* SECURITY UPDATE: Returning point past of the buffer
- debian/patches/CVE-2022-30556.patch: use filters consitently
in modules/lua/lua_request.c.
- CVE-2022-30556
* SECURITY UPDATE: Bypass IP authentication
- debian/patches/CVE-2022-31813.patch: to clear
hop-by-hop first and fixup last in modules/proxy/proxy_util.c.
- CVE-2022-31813
-- Leonidas Da Silva Barbosa <email address hidden> Tue, 14 Jun 2022 09:30:21 -0300
-
apache2 (2.4.52-1ubuntu4) jammy; urgency=medium
* d/apache2.postrm: Include md5 sum for updated index.html
-- Bryce Harrington <email address hidden> Thu, 24 Mar 2022 17:35:40 -0700
-
apache2 (2.4.52-1ubuntu3) jammy; urgency=medium
* d/index.html:
- Redesign page's heading for the new logo
- Use the Ubuntu font where available
- Update service management directions
- Copyedit grammar
- Light reformatting and whitespace cleanup
* d/icons/ubuntu-logo.png: Refresh ubuntu logo
(LP: #1966004)
-- Bryce Harrington <email address hidden> Wed, 23 Mar 2022 16:18:11 -0700
-
apache2 (2.4.52-1ubuntu2) jammy; urgency=medium
* SECURITY UPDATE: OOB read in mod_lua via crafted request body
- debian/patches/CVE-2022-22719.patch: error out if lua_read_body() or
lua_write_body() fail in modules/lua/lua_request.c.
- CVE-2022-22719
* SECURITY UPDATE: HTTP Request Smuggling via error discarding the
request body
- debian/patches/CVE-2022-22720.patch: simpler connection close logic
if discarding the request body fails in modules/http/http_filters.c,
server/protocol.c.
- CVE-2022-22720
* SECURITY UPDATE: overflow via large LimitXMLRequestBody
- debian/patches/CVE-2022-22721.patch: make sure and check that
LimitXMLRequestBody fits in system memory in server/core.c,
server/util.c, server/util_xml.c.
- CVE-2022-22721
* SECURITY UPDATE: out-of-bounds write in mod_sed
- debian/patches/CVE-2022-23943-1.patch: use size_t to allow for larger
buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
modules/filters/mod_sed.c, modules/filters/sed1.c.
- debian/patches/CVE-2022-23943-2.patch: improve the logic flow in
modules/filters/mod_sed.c.
- CVE-2022-23943
-- Marc Deslauriers <email address hidden> Thu, 17 Mar 2022 09:39:54 -0400
-
apache2 (2.4.52-1ubuntu1) jammy; urgency=medium
* Merge with Debian unstable (LP: #1959924). Remaining changes:
- debian/{control, apache2.install, apache2-utils.ufw.profile,
apache2.dirs}: Add ufw profiles.
(LP 261198)
- debian/apache2.py, debian/apache2-bin.install: Add apport hook.
(LP 609177)
- d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
d/s/include-binaries: replace Debian with Ubuntu on default
page and add Ubuntu icon file.
(LP 1288690)
* Dropped:
- d/p/support-openssl3-*.patch: Backport various patches from
https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
failure to load when using OpenSSL 3.
(LP #1951476)
[Included in upstream release 2.4.52]
- d/apache2ctl: Also use systemd for graceful if it is in use.
(LP 1832182)
[This introduced a performance regression.]
- d/apache2ctl: Also use /run/systemd to check for systemd usage.
(LP 1918209)
[Not needed]
-- Bryce Harrington <email address hidden> Thu, 03 Feb 2022 10:25:47 -0800
-
apache2 (2.4.51-2ubuntu1) jammy; urgency=medium
* Merge with Debian unstable. Remaining changes:
- debian/{control, apache2.install, apache2-utils.ufw.profile,
apache2.dirs}: Add ufw profiles.
(LP 261198)
- debian/apache2.py, debian/apache2-bin.install: Add apport hook.
(LP 609177)
- d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
d/s/include-binaries: replace Debian with Ubuntu on default
page and add Ubuntu icon file.
(LP 1288690)
- d/p/support-openssl3-*.patch: Backport various patches from
https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
failure to load when using OpenSSL 3.
(LP #1951476)
* Dropped:
- d/apache2ctl: Also use systemd for graceful if it is in use.
(LP: 1832182)
[This introduced a performance regression.]
- d/apache2ctl: Also use /run/systemd to check for systemd usage.
(LP 1918209)
[Not needed]
- debian/patches/CVE-2021-33193.patch: refactor request parsing in
include/ap_mmn.h, include/http_core.h, include/http_protocol.h,
include/http_vhost.h, modules/http2/h2_request.c, server/core.c,
server/core_filters.c, server/protocol.c, server/vhost.c.
[Fixed in 2.4.48-4]
- debian/patches/CVE-2021-34798.patch: add NULL check in
server/scoreboard.c.
[Fixed in 2.4.49-1]
- debian/patches/CVE-2021-36160.patch: fix PATH_INFO setting for
generic worker in modules/proxy/mod_proxy_uwsgi.c.
[Fixed in 2.4.49-1]
- debian/patches/CVE-2021-39275.patch: fix ap_escape_quotes
substitution logic in server/util.c.
[Fixed in 2.4.49-1]
- arbitrary origin server via crafted request uri-path
+ debian/patches/CVE-2021-40438-pre1.patch: faster unix socket path
parsing in the "proxy:" URL in modules/proxy/mod_proxy.c,
modules/proxy/proxy_util.c.
+ debian/patches/CVE-2021-40438.patch: add sanity checks on the
configured UDS path in modules/proxy/proxy_util.c.
[Fixed in 2.4.49-3]
- SECURITY REGRESSION: Issues in UDS URIs. (LP #1945311)
+ debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
rules in modules/mappers/mod_rewrite.c.
+ debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
hostname in modules/mappers/mod_rewrite.c,
modules/proxy/proxy_util.c.
[Fixed in 2.4.49-3]
-- Bryce Harrington <email address hidden> Thu, 16 Dec 2021 14:09:26 -0800
-
apache2 (2.4.48-3.1ubuntu4) jammy; urgency=medium
* d/p/support-openssl3-*.patch: Backport various patches from
https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
failure to load when using OpenSSL 3. (LP: #1951476)
-- Sergio Durigan Junior <email address hidden> Fri, 26 Nov 2021 16:07:56 -0500
-
apache2 (2.4.48-3.1ubuntu3) impish; urgency=medium
* SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
- debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
rules in modules/mappers/mod_rewrite.c.
- debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
hostname in modules/mappers/mod_rewrite.c,
modules/proxy/proxy_util.c.
-- Marc Deslauriers <email address hidden> Tue, 28 Sep 2021 08:52:26 -0400
