David Anes e36de76227 Accepting request 981544 from home:david.anes:branches:Apache ...

Merge sroeder (details about CVEs) and pgajdos requests.

- update httpd-framework to svn revision 1898917

- version update to 2.4.54
  Changes with Apache 2.4.54
    *) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
       hop-by-hop mechanism (cve.mitre.org)
       Apache HTTP Server 2.4.53 and earlier may not send the
       X-Forwarded-* headers to the origin server based on client side
       Connection header hop-by-hop mechanism.
       This may be used to bypass IP based authentication on the origin
       server/application.
       Credits: The Apache HTTP Server project would like to thank
       Gaetan Ferry (Synacktiv) for reporting this issue
    *) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
       websockets (cve.mitre.org)
       Apache HTTP Server 2.4.53 and earlier may return lengths to
       applications calling r:wsread() that point past the end of the
       storage allocated for the buffer.
       Credits: The Apache HTTP Server project would like to thank
       Ronald Crane (Zippenhop LLC) for reporting this issue
    *) SECURITY: CVE-2022-30522: mod_sed denial of service
       (cve.mitre.org)
       If Apache HTTP Server 2.4.53 is configured to do transformations
       with mod_sed in contexts where the input to mod_sed may be very
       large, mod_sed may make excessively large memory allocations and
       trigger an abort.
       Credits: This issue was found by Brian Moussalli from the JFrog
       Security Research team
    *) SECURITY: CVE-2022-29404: Denial of service in mod_lua
       r:parsebody (cve.mitre.org)

OBS-URL: https://build.opensuse.org/request/show/981544
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=670

2022-06-09 16:03:37 +00:00

709 KiB (Stored with Git LFS)

Raw Permalink History

View Raw