apache2: Fix CVE-2018-11763

PATCH New [email protected] 1 participant 1 message Oct 29, 2018

lore

Share & tools

lore

[email protected]

author

2018-10-29 07:25 UTC #0 lore raw

PATCH 1/1 apache2: Fix CVE-2018-11763

From: Mingli Yu <[email protected]>

mod_http2: connection IO event handling reworked. Instead of reacting on incoming bytes, the state machine now acts on incoming frames that are affecting it. This reduces state transitions.

Reference: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-11763.html

Signed-off-by Mingli Yu <[email protected]>

---
 .../apache2/apache2-native_2.4.34.bb          |   1 +
 .../apache2/apache2/CVE-2018-11763.patch      | 512 ++++++++++++++++++
 .../recipes-httpd/apache2/apache2_2.4.34.bb   |   1 +
 3 files changed, 514 insertions(+)
 create mode 100644 meta-webserver/recipes-httpd/apache2/apache2/CVE-2018-11763.patch

meta-webserver/recipes-httpd/apache2/apache2-native_2.4.34.bb +1 -0

index a3a6804d8..4cc384546 100644
@@ -10,6 +10,7 @@ inherit autotools pkgconfig native
 
 SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
            file://0001-configure-use-pkg-config-for-PCRE-detection.patch \
+           file://CVE-2018-11763.patch \
           "
 
 S = "${WORKDIR}/httpd-${PV}"

meta-webserver/recipes-httpd/apache2/apache2/CVE-2018-11763.patch new file +512 -0

512 lines not on this page · raw message

meta-webserver/recipes-httpd/apache2/apache2_2.4.34.bb +1 -0

index a92ec5458..a87e3847f 100644
@@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
            file://httpd-2.4.3-fix-race-issue-of-dir-install.patch \
            file://0001-configure-use-pkg-config-for-PCRE-detection.patch \
            file://configure-allow-to-disable-selinux-support.patch \
+           file://CVE-2018-11763.patch \
            file://init \
            file://apache2-volatile.conf \
            file://apache2.service \

Signature · 1 line

2.17.1