Changeset 2774 for trunk/server/fedora

Timestamp:

Jul 18, 2016, 7:53:10 PM (8 years ago)

Author:

andersk

Message:

Apply the 2015 suexec patch for CVE-2016-5387 “httpoxy”.

Also remove our inexplicable whitelist entry for HTTPS_* environment
variables.

File:

• trunk/server/fedora/specs/httpd.spec.patch (modified) (4 diffs)

trunk/server/fedora/specs/httpd.spec.patch

@@ -10 +10 @@
  Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
  Source1: index.html
-@@ -65,6 +65,15 @@
+@@ -65,6 +65,16 @@
  Patch101: httpd-2.4.6-CVE-2014-3581.patch
  Patch102: httpd-2.4.10-CVE-2014-3583.patch
@@ -22 +22 @@
 +Patch1006: httpd-suexec-journald.patch
 +Patch1007: httpd-bug57070.patch
++Patch1008: httpd-suexec-CVE-2016-5387.patch
 +
  License: ASL 2.0
@@ -50 +51 @@
  
  %description -n mod_ssl
-@@ -190,6 +202,14 @@
+@@ -190,6 +202,15 @@
  %patch55 -p1 -b .malformedhost
  %patch56 -p1 -b .uniqueid
@@ -61 +62 @@
 +%patch1006 -p1 -b .journald
 +%patch1007 -p0 -b .bug57070
++%patch1008 -p0 -b .CVE-2016-5387
 +
  # Patch in the vendor string