From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 1/1] gnu: httpd: Fix CVE-2016-8740. Date: Tue, 6 Dec 2016 02:28:39 -0500 Message-ID: <9c1156dad85b54e71fca1a73ec8f24e31f82d8e4.1481009302.git.leo@famulari.name> Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55749) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cEABI-0003ew-LE for guix-devel@gnu.org; Tue, 06 Dec 2016 02:28:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cEABE-0001D6-KS for guix-devel@gnu.org; Tue, 06 Dec 2016 02:28:52 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:40227) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cEABE-0001Cg-CW for guix-devel@gnu.org; Tue, 06 Dec 2016 02:28:48 -0500 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 29A3C7E8C3 for ; Tue, 6 Dec 2016 02:28:47 -0500 (EST) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/patches/httpd-cve-2016-8740.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/web.scm (httpd)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/patches/httpd-cve-2016-8740.patch | 43 ++++++++++++++++++++++++++ gnu/packages/web.scm | 1 + 3 files changed, 45 insertions(+) create mode 100644 gnu/packages/patches/httpd-cve-2016-8740.patch diff --git a/gnu/local.mk b/gnu/local.mk index 96689a7d6..3643fdfd6 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -620,6 +620,7 @@ dist_patch_DATA = \ %D%/packages/patches/hdf-eos5-fortrantests.patch \ %D%/packages/patches/higan-remove-march-native-flag.patch \ %D%/packages/patches/hop-linker-flags.patch \ + %D%/packages/patches/httpd-cve-2016-8740.patch \ %D%/packages/patches/hydra-disable-darcs-test.patch \ %D%/packages/patches/hypre-doc-tables.patch \ %D%/packages/patches/hypre-ldflags.patch \ diff --git a/gnu/packages/patches/httpd-cve-2016-8740.patch b/gnu/packages/patches/httpd-cve-2016-8740.patch new file mode 100644 index 000000000..6988bc337 --- /dev/null +++ b/gnu/packages/patches/httpd-cve-2016-8740.patch @@ -0,0 +1,43 @@ +Fix CVE-2016-8740 (mod_http2: properly crafted, endless HTTP/2 CONTINUATION +frames could be used to exhaust all server's memory.): + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740 +https://httpd.apache.org/security/vulnerabilities_24.html + +Patched copied from upstream mailing list: +https://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E + +Index: modules/http2/h2_stream.c +=================================================================== +--- a/modules/http2/h2_stream.c (revision 1771866) ++++ b/modules/http2/h2_stream.c (working copy) +@@ -322,18 +322,18 @@ + HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE); + } + } +- } +- +- if (h2_stream_is_scheduled(stream)) { +- return h2_request_add_trailer(stream->request, stream->pool, +- name, nlen, value, vlen); +- } +- else { +- if (!input_open(stream)) { +- return APR_ECONNRESET; ++ ++ if (h2_stream_is_scheduled(stream)) { ++ return h2_request_add_trailer(stream->request, stream->pool, ++ name, nlen, value, vlen); + } +- return h2_request_add_header(stream->request, stream->pool, +- name, nlen, value, vlen); ++ else { ++ if (!input_open(stream)) { ++ return APR_ECONNRESET; ++ } ++ return h2_request_add_header(stream->request, stream->pool, ++ name, nlen, value, vlen); ++ } + } + } + diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm index 697bab8e5..0162072c6 100644 --- a/gnu/packages/web.scm +++ b/gnu/packages/web.scm @@ -90,6 +90,7 @@ (method url-fetch) (uri (string-append "mirror://apache/httpd/httpd-" version ".tar.bz2")) + (patches (search-patches "httpd-cve-2016-8740.patch")) (sha256 (base32 "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc")))) -- 2.11.0