apache2/apache2-start_apache2
David Anes 9ac936a203 - Update to 2.4.62
*) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
     mod_rewrite in server/vhost context on Windows (cve.mitre.org)
     [boo#1228098]
     SSRF in Apache HTTP Server on Windows with mod_rewrite in
     server/vhost context, allows to potentially leak NTML hashes to
     a malicious server via SSRF and malicious requests.
     Users are recommended to upgrade to version 2.4.62 which fixes
     this issue.
     Credits: Smi1e (DBAPPSecurity Ltd.)
  *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
     disclosure with handlers configured via AddType (cve.mitre.org)
     [boo#1228097]
     A partial fix for  CVE-2024-39884 in the core of Apache HTTP
     Server 2.4.61 ignores some use of the legacy content-type based
     configuration of handlers. "AddType" and similar configuration,
     under some circumstances where files are requested indirectly,
     result in source code disclosure of local content. For example,
     PHP scripts may be served instead of interpreted.
     Users are recommended to upgrade to version 2.4.62, which fixes
     this issue.
  *) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
     "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
     with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
     PR 69160 [Yann Ylavic]
  *) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
     [Joe Orton]
  *) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
     via OpenSSL 3.x providers.  [Ingo Franzki <ifranzki linux.ibm.com>]
  *) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0.
     [Ruediger Pluem, Yann Ylavic]
  *) mpm_worker: Fix possible warning (AH00045) about children processes not
     terminating timely.  [Yann Ylavic]

OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=706
2024-08-07 12:48:58 +00:00

184 lines
5.3 KiB
Bash

#!/bin/sh
#
# Copyright (c) 1996, 1997, 1998 S.u.S.E. GmbH
# Copyright (c) 1998, 1999, 2000, 2001 SuSE GmbH
# Copyright (c) 2002, 2003, (2004?) SuSE Linux AG
# Copyright (c) 2004(?), 2005, 2006, 2007, 2008 SUSE Linux Products GmbH
#
# Authors: Rolf Haberrecker <apache@suse.de>, 2001
# Peter Poeml <apache@suse.de>, 2002, 2003, 2004, 2005, 2006, 2007,
# 2008, 2009, 2010
#
#
. /usr/share/apache2/script-helpers
#
# which instance should we will run, comes from
# apache2@ service file
#
unset instance_suffix
if [ -n "$START_APACHE_INSTANCE" ]; then
instance_suffix="@$START_APACHE_INSTANCE"
fi
#
# load sysconfig variables APACHE_* from instance sysconfig
# file; START_APACHE_SYSCONFIG_FILE can be used for change the system
# default (e. g. for testing purposes)
#
export HTTPD_SYSCONFIG_FILE=${START_APACHE_SYSCONFIG_FILE:-/etc/sysconfig/apache2${instance_suffix}}
load_sysconfig
#
# dir to locate pid file into; START_APACHE_RUN_DIR can be used
# to change the system default (e. g. for testing purposes)
#
run_dir="${START_APACHE_RUN_DIR:-/run}"
unset server_flags
#
# server_flags: -DSYSCONFIG
#
if [ -f "$HTTPD_SYSCONFIG_FILE" ]; then
server_flags="$server_flags -DSYSCONFIG"
fi
#
# figure out correct apache2 binary (/usr/sbin/httpd-prefork,
# /usr/sbin/httpd-worker, etc.) and serverflags
#
find_mpm
if [ -n "$HTTPD_MPM" ]; then
apache_bin="$HTTPD_SBIN_BASE-$HTTPD_MPM"
if ! [ -x $apache_bin ]; then
echo >&2 "$apache_bin-$APACHE_MPM is not a valid httpd binary."
echo >&2 "Check your APACHE_MPM setting in /etc/sysconfig/apache2."
exit 1
fi
else
# take /usr/sbin/httpd, which will
# exist thanks to update alternatives
apache_bin="$HTTPD_SBIN_BASE"
fi
# server flags from APACHE_SERVER_FLAGS
for i in $APACHE_SERVER_FLAGS; do
case $i in
-D) ;;
-D*) server_flags="$server_flags $i";;
*) server_flags="$server_flags -D$i";;
esac
done
#
# head configuration file
#
httpd_conf=${APACHE_HTTPD_CONF:-/etc/apache2${instance_suffix}/httpd.conf}
#
# where to write configuration depending on sysconfig variables
#
sysconfd_dir=$(dirname $httpd_conf)/sysconfig${instance_suffix}.d/
#
# set PidFile to this file name; PidFile should not
# be used in the configuration to change this, otherwise
# stopping will not work
#
pid_file=$run_dir/httpd${instance_suffix}.pid
#
# involve the sysconfig variables
#
[ -d ${sysconfd_dir} ] || mkdir -p ${sysconfd_dir} || exit 1
for c in global.conf include.conf loadmodule.conf; do
echo "# File generated from $HTTPD_SYSCONFIG_FILE, do not edit. Edit the sysconfig file instead." > ${sysconfd_dir}/$c
done
# APACHE_ACCESS_LOG -> global.conf
if [ -n "$APACHE_ACCESS_LOG" ]; then
echo "CustomLog $APACHE_ACCESS_LOG" | sed 's:,:\nCustomLog :' >> ${sysconfd_dir}/global.conf
fi
# APACHE_CONF_INCLUDE_FILES -> include.conf
for file in $APACHE_CONF_INCLUDE_FILES; do
test ${file:0:1} = / || file=/etc/apache2/$file
if [ ! -e $file ]; then
continue
fi
echo "Include $file" >> ${sysconfd_dir}/include.conf
done
# APACHE_CONF_INCLUDE_DIRS -> include.conf
for dir in $APACHE_CONF_INCLUDE_DIRS; do
test ${dir:0:1} = / || dir=/etc/apache2/$dir
if ! ( [ -e $dir ] || [ -e ${dir%/*} ] ); then
continue
fi
echo "Include $dir" >> ${sysconfd_dir}/include.conf
done
# APACHE_SERVERADMIN -> global.conf
if [ -n "$APACHE_SERVERADMIN" ]; then
echo "ServerAdmin $APACHE_SERVERADMIN" >> ${sysconfd_dir}/global.conf
fi
# APACHE_SERVERNAME -> global.conf
if [ -n "$APACHE_SERVERNAME" ]; then
echo "ServerName $APACHE_SERVERNAME" >> ${sysconfd_dir}/global.conf
fi
# APACHE_START_TIMEOUT
# not used nowadays
# APACHE_SERVERSIGNATURE -> global.conf
if [ -n "$APACHE_SERVERSIGNATURE" ]; then
echo "ServerSignature $APACHE_SERVERSIGNATURE" >> ${sysconfd_dir}/global.conf
fi
# APACHE_LOGLEVEL -> global.conf
if [ -n "$APACHE_LOGLEVEL" ]; then
echo "LogLevel $APACHE_LOGLEVEL" >> ${sysconfd_dir}/global.conf
fi
# APACHE_USE_CANONICAL_NAME -> global.conf
if [ -n "$APACHE_USE_CANONICAL_NAME" ]; then
echo "UseCanonicalName $APACHE_USE_CANONICAL_NAME" >> ${sysconfd_dir}/global.conf
fi
# APACHE_SERVERTOKENS -> global.conf
if [ -n "$APACHE_SERVERTOKENS" ]; then
echo "ServerTokens $APACHE_SERVERTOKENS" >> ${sysconfd_dir}/global.conf
fi
# APACHE_TACEENABLE -> global.conf
if [ -n "$APACHE_TRACEENABLE" ]; then
echo "TraceEnable $APACHE_TRACEENABLE" >> ${sysconfd_dir}/global.conf
fi
# APACHE_EXTENDED_STATUS -> global.conf
if [ -n "$APACHE_EXTENDED_STATUS" ]; then
if [ "$APACHE_EXTENDED_STATUS" == "lua" ]; then
server_flags="$server_flags -DLUA_STATUS"
elif [ "$APACHE_EXTENDED_STATUS" == "on" ]; then
server_flags="$server_flags -DEXTENDED_STATUS"
fi
fi
# APACHE_MODULES -> loadmodule.conf
get_module_list
module_ids=($HTTPD_MODULE_IDS)
module_paths=($HTTPD_MODULE_PATHS)
for i in "${!module_ids[@]}"; do
echo "LoadModule ${module_ids[$i]} ${module_paths[$i]}" >> ${sysconfd_dir}/loadmodule.conf
done
#
# a proper home should be set, otherwise the server might end up
# with HOME=/root and some script might try to use that
#
HOME=/var/lib/apache2${instance_suffix}
#
# run Apache
#
exec $apache_bin $server_flags \
-C "PidFile $pid_file" \
-C "Include $sysconfd_dir/loadmodule.conf" \
-C "Include $sysconfd_dir/global.conf" \
-f $httpd_conf \
-c "Include $sysconfd_dir/include.conf" \
$@
exit 0