apache2/httpd-2.4.54.tar.bz2.asc

Accepting request 981544 from home:david.anes:branches:Apache Merge sroeder (details about CVEs) and pgajdos requests. - update httpd-framework to svn revision 1898917 - version update to 2.4.54 Changes with Apache 2.4.54 ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (cve.mitre.org) Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Credits: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with websockets (cve.mitre.org) Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Credits: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue ) SECURITY: CVE-2022-30522: mod_sed denial of service (cve.mitre.org) If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Credits: This issue was found by Brian Moussalli from the JFrog Security Research team *) SECURITY: CVE-2022-29404: Denial of service in mod_lua r:parsebody (cve.mitre.org) OBS-URL: https://build.opensuse.org/request/show/981544 OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=670 2022-06-09 16:03:37 +00:00			`-----BEGIN PGP SIGNATURE-----`
			`Comment: GPGTools - https://gpgtools.org`

			`iQIzBAABCgAdFiEEJvUe+agvSstD8ZA+03fJ59GUTGYFAmKeDckACgkQ03fJ59GU`
			`TGZzxA/+PAjEiG34ZvJwlKfuGUUdn25V5UaNW7Mxms7Q+PM/hx1q8GyZ0j9dFfTJ`
			`F8qbB+39dAJDcj6QyJxXUQFooDJ00ZrA/qOQyWjKEvtYkvGePxOZBYdW2sxk1+O8`
			`Kl3AwLE6ijLYeNJfvJSspWOMknA8FA3gspWltaZ88rVB+Dqu5+hvis3SP1CSpVyx`
			`OedsxUrqdOa5LkXs9WoBNIR9anukf8vVncGlgo8veSwblUCYx2jW2KCqMKMEkR1j`
			`6ErMsiySMUhK3QpY5SXQjX0hocnV/2TSRrj9q/1ppX/IXRQOixiyAb4go3bOMsLq`
			`ixE0Cmokt4vAz5scaK74/tD+74rL/cKCh1f/OwNnm/LQch0XCoGU/kExm3aCYVPT`
			`gTdxGysKI4+0WKb2rP5JrfDQqjzPrUzpQ+Vc0h7+4dzvbDAptWLb7893VTs4weJY`
			`r6hpSsAZZwPHWv5dO21+rrExEyVup7Q6DeMg8QYtuVkAHeKPaitolI1yGMnPwPjO`
			`uwei49zC4vUiD9RX59KBxSGDf/+4iXVKRVgk46piSEOfYN4Q9YfM2LSEPth3QjaD`
			`sJwgHW+w4/B/z/LNLtr79H1dDVr2tfMb1GQ6wIkzKPxkevV5SbNB8MeAW+MH02wM`
			`0xJQgbl/lyCS/PHt04OgI28vg55CzrU5RdTJxs+KgH9x5Kat7d4=`
			`=pokb`
			`-----END PGP SIGNATURE-----`