pkgsrc/www/apache22, branch pkgsrc_2008Q2 [no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=pkgsrc_2008Q2 2008-08-12T18:16:33Z Pullup ticket 2476 - requested by tron 2008-08-12T18:16:33Z spz spz 2008-08-12T18:16:33Z urn:sha1:a7f819e28919fbb0603dee904b3cf7cbb2a6c224 Security fix Revisions pulled up: - pkgsrc/www/apache22/Makefile 1.28 - pkgsrc/www/apache22/distinfo 1.12 - pkgsrc/www/apache22/patches/patch-ab 1.8 Module Name: pkgsrc Committed By: tron Date: Sat Aug 9 22:16:44 UTC 2008 Modified Files: pkgsrc/www/apache22: Makefile distinfo Added Files: pkgsrc/www/apache22/patches: patch-ab Log Message: Add patch from Apache SVN repository to avoid cross-site scripting attacks in the FTP proxy module. This fixes the security vulnerability reported in CVE-2008-2939. To generate a diff of this commit: cvs rdiff -r1.27 -r1.28 pkgsrc/www/apache22/Makefile cvs rdiff -r1.11 -r1.12 pkgsrc/www/apache22/distinfo cvs rdiff -r0 -r1.8 pkgsrc/www/apache22/patches/patch-ab Update "apache22" package to version 2.2.9. 2008-06-18T21:38:00Z tron tron 2008-06-18T21:38:00Z urn:sha1:b13a234b28154de06ace1ae0f7dc4d3135ae602f This version of Apache is principally a bug and security fix release. The following potential security flaws are addressed: - CVE-2008-2364: mod_proxy_http: Better handling of excessive interim responses from origin server to prevent potential denial of service and high memory usage. Reported by Ryujiro Shibuya. - CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager interface. pkgsrc related notes: - CVE-2008-2364 was already fixed in "pkgsrc" - CVE-2007-6420 doesn't affect the package in the default configuration because the "proxy_balancer" isn't enabled. Add patch for CVE-2008-2364 from the Apache SVN repository. 2008-06-12T14:12:19Z tron tron 2008-06-12T14:12:19Z urn:sha1:9877974439cd6c6fe77f6b11a3f176cb106e9e75 Second round of explicit pax dependencies. As reminded by tnn@, 2008-05-26T02:13:14Z joerg joerg 2008-05-26T02:13:14Z urn:sha1:2374ca422f2eb8b46ed600c7bb21740b2865d899 many packages used to use ${PAX}. Use the common way of directly calling pax, it is created as tool after all. Convert to use PLIST_VARS instead of manually passing "@comment " 2008-04-12T22:42:57Z jlam jlam 2008-04-12T22:42:57Z urn:sha1:84db467ec7c8386066718011f8d47775d5608811 through PLIST_SUBST to the plist module. Update to 2.2.8, please check http://www.apache.org/dist/httpd/CHANGES_2.2.8 2008-01-21T15:07:10Z xtraeme xtraeme 2008-01-21T15:07:10Z urn:sha1:58922d83962b247d223934eb39fd0bebd13020c1 for the list of changes. Per the process outlined in revbump(1), perform a recursive revbump 2008-01-18T05:06:18Z tnn tnn 2008-01-18T05:06:18Z urn:sha1:1c8e24b168b5909ecc586bdbb660570b490d92ef on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@ db4 update related revision bump 2008-01-12T11:36:28Z adam adam 2008-01-12T11:36:28Z urn:sha1:54a9e8b02ddc06323222b7d4f5cc4bd2d0333725 Update www/apache to 2.2.6nb1 2007-12-04T12:08:45Z abs abs 2007-12-04T12:08:45Z urn:sha1:aabc40fadefac9ad55aec37a6693de06d7ba15f2 Add apache SVN revision 574884 to fix garbage characters in Server header http://issues.apache.org/bugzilla/show_bug.cgi?id=43334 When it hits, this issue can completely screw up returned pages if the Server header gets embedded newlines Remove duplicate entry for "share/httpd/icons/README.html". 2007-09-10T20:36:40Z tron tron 2007-09-10T20:36:40Z urn:sha1:26ec8bac0ecfe22ad8c309ec4cc9bf0b1746f9d3 Pointed out by Geert Hendrickx in private e-mail.