From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 1/1] gnu: httpd: Update to 2.4.25 [fixes CVE-2016-{0736, 2161, 5387, 8743}]. Date: Wed, 1 Feb 2017 02:09:54 -0500 Message-ID: <19be6e64c93206bf593581cdb50d00a26ef5fb80.1485931552.git.leo@famulari.name> References: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42563) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cYp3M-0000Cf-Rh for guix-devel@gnu.org; Wed, 01 Feb 2017 02:10:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cYp3J-0002az-5X for guix-devel@gnu.org; Wed, 01 Feb 2017 02:10:04 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:57670) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cYp3J-0002aW-1G for guix-devel@gnu.org; Wed, 01 Feb 2017 02:10:01 -0500 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 0456D2450F for ; Wed, 1 Feb 2017 02:10:00 -0500 (EST) In-Reply-To: In-Reply-To: References: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/web.scm (httpd): Update to 2.4.25. [source]: Remove obsolete patch 'httpd-CVE-2016-8740.patch'. * gnu/packages/patches/httpd-CVE-2016-8740.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. --- gnu/local.mk | 1 - gnu/packages/patches/httpd-CVE-2016-8740.patch | 36 -------------------------- gnu/packages/web.scm | 6 ++--- 3 files changed, 2 insertions(+), 41 deletions(-) delete mode 100644 gnu/packages/patches/httpd-CVE-2016-8740.patch diff --git a/gnu/local.mk b/gnu/local.mk index da4dbb0d2..a04700e92 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -630,7 +630,6 @@ dist_patch_DATA = \ %D%/packages/patches/hdf-eos5-fortrantests.patch \ %D%/packages/patches/higan-remove-march-native-flag.patch \ %D%/packages/patches/hop-linker-flags.patch \ - %D%/packages/patches/httpd-CVE-2016-8740.patch \ %D%/packages/patches/hydra-disable-darcs-test.patch \ %D%/packages/patches/hypre-doc-tables.patch \ %D%/packages/patches/hypre-ldflags.patch \ diff --git a/gnu/packages/patches/httpd-CVE-2016-8740.patch b/gnu/packages/patches/httpd-CVE-2016-8740.patch deleted file mode 100644 index 17ba323cc..000000000 --- a/gnu/packages/patches/httpd-CVE-2016-8740.patch +++ /dev/null @@ -1,36 +0,0 @@ -This patch applies against httpd-2.4.23 and shouldn't be needed in later releases -http://openwall.com/lists/oss-security/2016/12/05/17 -Index: modules/http2/h2_stream.c -=================================================================== ---- modules/http2/h2_stream.c (revision 1771866) -+++ modules/http2/h2_stream.c (working copy) -@@ -322,18 +322,18 @@ - HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE); - } - } -- } -- -- if (h2_stream_is_scheduled(stream)) { -- return h2_request_add_trailer(stream->request, stream->pool, -- name, nlen, value, vlen); -- } -- else { -- if (!input_open(stream)) { -- return APR_ECONNRESET; -+ -+ if (h2_stream_is_scheduled(stream)) { -+ return h2_request_add_trailer(stream->request, stream->pool, -+ name, nlen, value, vlen); - } -- return h2_request_add_header(stream->request, stream->pool, -- name, nlen, value, vlen); -+ else { -+ if (!input_open(stream)) { -+ return APR_ECONNRESET; -+ } -+ return h2_request_add_header(stream->request, stream->pool, -+ name, nlen, value, vlen); -+ } - } - } - diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm index 108ccafd2..8cc80a2c4 100644 --- a/gnu/packages/web.scm +++ b/gnu/packages/web.scm @@ -88,16 +88,14 @@ (define-public httpd (package (name "httpd") - (version "2.4.23") + (version "2.4.25") (source (origin (method url-fetch) (uri (string-append "mirror://apache/httpd/httpd-" version ".tar.bz2")) (sha256 (base32 - "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc")) - (patches (search-patches "httpd-CVE-2016-8740.patch")) - (patch-flags '("-p0")))) + "1cl0bkqg6srb1sypga0cn8dcmdyxldavij73zmmkxvlz3kgw4zpq")))) (build-system gnu-build-system) (native-inputs `(("pcre" ,pcre "bin"))) ;for 'pcre-config' (inputs `(("apr" ,apr) -- 2.11.0