* [PATCH 1/1] gnu: httpd: Update to 2.4.25 [fixes CVE-2016-{0736, 2161, 5387, 8743}].
2017-02-01 7:09 [PATCH 0/1] Apache httpd 2.4.25 security update Leo Famulari
@ 2017-02-01 7:09 ` Leo Famulari
2017-02-01 22:51 ` Ludovic Courtès
0 siblings, 1 reply; 3+ messages in thread
From: Leo Famulari @ 2017-02-01 7:09 UTC (permalink / raw)
To: guix-devel
* gnu/packages/web.scm (httpd): Update to 2.4.25.
[source]: Remove obsolete patch 'httpd-CVE-2016-8740.patch'.
* gnu/packages/patches/httpd-CVE-2016-8740.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
---
gnu/local.mk | 1 -
gnu/packages/patches/httpd-CVE-2016-8740.patch | 36 --------------------------
gnu/packages/web.scm | 6 ++---
3 files changed, 2 insertions(+), 41 deletions(-)
delete mode 100644 gnu/packages/patches/httpd-CVE-2016-8740.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index da4dbb0d2..a04700e92 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -630,7 +630,6 @@ dist_patch_DATA = \
%D%/packages/patches/hdf-eos5-fortrantests.patch \
%D%/packages/patches/higan-remove-march-native-flag.patch \
%D%/packages/patches/hop-linker-flags.patch \
- %D%/packages/patches/httpd-CVE-2016-8740.patch \
%D%/packages/patches/hydra-disable-darcs-test.patch \
%D%/packages/patches/hypre-doc-tables.patch \
%D%/packages/patches/hypre-ldflags.patch \
diff --git a/gnu/packages/patches/httpd-CVE-2016-8740.patch b/gnu/packages/patches/httpd-CVE-2016-8740.patch
deleted file mode 100644
index 17ba323cc..000000000
--- a/gnu/packages/patches/httpd-CVE-2016-8740.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-This patch applies against httpd-2.4.23 and shouldn't be needed in later releases
-http://openwall.com/lists/oss-security/2016/12/05/17
-Index: modules/http2/h2_stream.c
-===================================================================
---- modules/http2/h2_stream.c (revision 1771866)
-+++ modules/http2/h2_stream.c (working copy)
-@@ -322,18 +322,18 @@
- HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
- }
- }
-- }
--
-- if (h2_stream_is_scheduled(stream)) {
-- return h2_request_add_trailer(stream->request, stream->pool,
-- name, nlen, value, vlen);
-- }
-- else {
-- if (!input_open(stream)) {
-- return APR_ECONNRESET;
-+
-+ if (h2_stream_is_scheduled(stream)) {
-+ return h2_request_add_trailer(stream->request, stream->pool,
-+ name, nlen, value, vlen);
- }
-- return h2_request_add_header(stream->request, stream->pool,
-- name, nlen, value, vlen);
-+ else {
-+ if (!input_open(stream)) {
-+ return APR_ECONNRESET;
-+ }
-+ return h2_request_add_header(stream->request, stream->pool,
-+ name, nlen, value, vlen);
-+ }
- }
- }
-
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 108ccafd2..8cc80a2c4 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -88,16 +88,14 @@
(define-public httpd
(package
(name "httpd")
- (version "2.4.23")
+ (version "2.4.25")
(source (origin
(method url-fetch)
(uri (string-append "mirror://apache/httpd/httpd-"
version ".tar.bz2"))
(sha256
(base32
- "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))
- (patches (search-patches "httpd-CVE-2016-8740.patch"))
- (patch-flags '("-p0"))))
+ "1cl0bkqg6srb1sypga0cn8dcmdyxldavij73zmmkxvlz3kgw4zpq"))))
(build-system gnu-build-system)
(native-inputs `(("pcre" ,pcre "bin"))) ;for 'pcre-config'
(inputs `(("apr" ,apr)
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread