From owner-freebsd-apache@FreeBSD.ORG Mon Jul 8 11:40:57 2013
Return-Path:
Delivered-To: apache@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
by hub.freebsd.org (Postfix) with ESMTP id 75EEC438
for ; Mon, 8 Jul 2013 11:40:57 +0000 (UTC)
(envelope-from owner-bugmaster@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
[IPv6:2001:1900:2254:206c::16:87])
by mx1.freebsd.org (Postfix) with ESMTP id 68E0E1392
for ; Mon, 8 Jul 2013 11:40:57 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r68BeXcq053981
for ; Mon, 8 Jul 2013 11:40:57 GMT
(envelope-from owner-bugmaster@FreeBSD.org)
Received: (from gnats@localhost)
by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r68B69tV045656
for apache@FreeBSD.org; Mon, 8 Jul 2013 11:06:09 GMT
(envelope-from owner-bugmaster@FreeBSD.org)
Date: Mon, 8 Jul 2013 11:06:09 GMT
Message-Id: <201307081106.r68B69tV045656@freefall.freebsd.org>
X-Authentication-Warning: freefall.freebsd.org: gnats set sender to
owner-bugmaster@FreeBSD.org using -f
From: FreeBSD bugmaster
To: apache@FreeBSD.org
Subject: Current problem reports assigned to apache@FreeBSD.org
X-BeenThere: freebsd-apache@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Support of apache-related ports
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 08 Jul 2013 11:40:57 -0000
Note: to view an individual PR, use:
http://www.freebsd.org/cgi/query-pr.cgi?pr=(number).
The following is a listing of current problems submitted by FreeBSD users.
These represent problem reports covering all versions including
experimental development code and obsolete releases.
S Tracker Resp. Description
--------------------------------------------------------------------------------
o ports/180248 apache [patch] www/apache22: update to 2.2.25, drop warnings
o ports/179710 apache port www/mod_fastcgi extra patch to support apache24
a ports/176659 apache www/apache22 2.2.24 build error
o ports/165809 apache add mod_proxy patch to www/apache22
o ports/157554 apache www/apache22: Apache RLimitNPROC does not work as inte
o ports/125183 apache www/apache22 wrong SUEXEC_DOCROOT
o ports/124375 apache security/heimdal: www/mod_auth_kerb doesn't compile ag
7 problems total.
From owner-freebsd-apache@FreeBSD.ORG Wed Jul 10 19:10:01 2013
Return-Path:
Delivered-To: apache@smarthost.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
by hub.freebsd.org (Postfix) with ESMTP id 922A3591
for ; Wed, 10 Jul 2013 19:10:01 +0000 (UTC)
(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
[IPv6:2001:1900:2254:206c::16:87])
by mx1.freebsd.org (Postfix) with ESMTP id 70F57164E
for ; Wed, 10 Jul 2013 19:10:01 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r6AJA1rv092227
for ; Wed, 10 Jul 2013 19:10:01 GMT
(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r6AJA1w6092212;
Wed, 10 Jul 2013 19:10:01 GMT (envelope-from gnats)
Date: Wed, 10 Jul 2013 19:10:01 GMT
Message-Id: <201307101910.r6AJA1w6092212@freefall.freebsd.org>
To: apache@FreeBSD.org
From: dfilter@FreeBSD.ORG (dfilter service)
Subject: Re: ports/180248: commit references a PR
X-BeenThere: freebsd-apache@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
Reply-To: dfilter service
List-Id: Support of apache-related ports
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 10 Jul 2013 19:10:01 -0000
The following reply was made to PR ports/180248; it has been noted by GNATS.
From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:
Subject: Re: ports/180248: commit references a PR
Date: Wed, 10 Jul 2013 19:01:53 +0000 (UTC)
Author: ohauer
Date: Wed Jul 10 19:01:44 2013
New Revision: 322728
URL: http://svnweb.freebsd.org/changeset/ports/322728
Log:
- update to apache-2.2.25
- update vuxml with additional CVE-2013-1896 entry
Changes with Apache 2.2.25
http://www.apache.org/dist/httpd/CHANGES_2.2.25
*) SECURITY: CVE-2013-1896 (cve.mitre.org)
mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with
the source href (sent as part of the request body as XML) pointing to a
URI that is not configured for DAV will trigger a segfault. [Ben Reser
]
*) SECURITY: CVE-2013-1862 (cve.mitre.org)
mod_rewrite: Ensure that client data written to the RewriteLog is
escaped to prevent terminal escape sequences from entering the
log file. [Eric Covener, Jeff Trawick, Joe Orton]
*) core: Limit ap_pregsub() to 64MB and add ap_pregsub_ex() for longer
strings. The default limit for ap_pregsub() can be adjusted at compile
time by defining AP_PREGSUB_MAXLEN. [Stefan Fritsch, Jeff Trawick]
*) core: Support the SINGLE_LISTEN_UNSERIALIZED_ACCEPT optimization
on Linux kernel versions 3.x and above. PR 55121. [Bradley Heilbrun
]
*) mod_setenvif: Log error on substitution overflow.
[Stefan Fritsch]
*) mod_ssl/proxy: enable the SNI extension for backend TLS connections
[Kaspar Brand]
*) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
forwarding to SSL backends. PR 53134.
[Michael Weiser , Ruediger Pluem]
*) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits
in the error log to debug level. [William Rowe]
*) mod_ssl: Catch missing, mismatched or encrypted client cert/key pairs
with SSLProxyMachineCertificateFile/Path directives. PR 52212, PR 54698.
[Keith Burdis , Joe Orton, Kaspar Brand]
*) mod_proxy_balancer: Added balancer parameter failontimeout to allow server
admin to configure an IO timeout as an error in the balancer.
[Daniel Ruggeri]
*) mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind
password. [Daniel Ruggeri]
*) htdigest: Fix buffer overflow when reading digest password file
with very long lines. PR 54893. [Rainer Jung]
*) mod_dav: Ensure URI is correctly uriencoded on return. PR 54611
[Timothy Wood ]
*) mod_dav: Make sure that when we prepare an If URL for Etag comparison,
we compare unencoded paths. PR 53910 [Timothy Wood ]
*) mod_dav: Sending an If or If-Match header with an invalid ETag doesn't
result in a 412 Precondition Failed for a COPY operation. PR54610
[Timothy Wood ]
*) mod_dav: When a PROPPATCH attempts to remove a non-existent dead
property on a resource for which there is no dead property in the same
namespace httpd segfaults. PR 52559 [Diego Santa Cruz
]
*) mod_dav: Do not fail PROPPATCH when prop namespace is not known.
PR 52559 [Diego Santa Cruz ]
*) mod_dav: Do not segfault on PROPFIND with a zero length DBM.
PR 52559 [Diego Santa Cruz ]
PR: ports/180248
Submitted by: Jason Helfman jgh@
Deleted:
head/www/apache22/files/patch-modules__mappers__mod_rewrite.c
Modified:
head/security/vuxml/vuln.xml
head/www/apache22/Makefile
head/www/apache22/Makefile.modules
head/www/apache22/distinfo
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Wed Jul 10 17:57:38 2013 (r322727)
+++ head/security/vuxml/vuln.xml Wed Jul 10 19:01:44 2013 (r322728)
@@ -121,27 +121,27 @@ Note: Please add new entries to the beg
- apache22 -- mod_rewrite vulnerability
+ apache22 -- several vulnerabilities
apache22
- 2.2.02.2.24_1
+ 2.2.02.2.25
apache22-event-mpm
- 2.2.02.2.24_1
+ 2.2.02.2.25
apache22-itk-mpm
- 2.2.02.2.24_1
+ 2.2.02.2.25
apache22-peruser-mpm
- 2.2.02.2.24_1
+ 2.2.02.2.25
apache22-worker-mpm
- 2.2.02.2.24_1
+ 2.2.02.2.25
@@ -153,16 +153,21 @@ Note: Please add new entries to the beg
non-printable characters, which might allow remote attackers to
execute arbitrary commands via an HTTP request containing an
escape sequence for a terminal emulator.
+ mod_dav: Sending a MERGE request against a URI handled by
+ mod_dav_svn with the source href (sent as part of the request
+ body as XML) pointing to a URI that is not configured for DAV
+ will trigger a segfault.