From owner-freebsd-apache@FreeBSD.ORG Fri May 13 09:22:54 2011 Return-Path: Delivered-To: apache@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B6DCC106564A for ; Fri, 13 May 2011 09:22:54 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from qmta14.emeryville.ca.mail.comcast.net (qmta14.emeryville.ca.mail.comcast.net [76.96.27.212]) by mx1.freebsd.org (Postfix) with ESMTP id A074C8FC0A for ; Fri, 13 May 2011 09:22:54 +0000 (UTC) Received: from omta20.emeryville.ca.mail.comcast.net ([76.96.30.87]) by qmta14.emeryville.ca.mail.comcast.net with comcast id ixKp1g0021smiN4AExNuqb; Fri, 13 May 2011 09:22:54 +0000 Received: from koitsu.dyndns.org ([67.180.84.87]) by omta20.emeryville.ca.mail.comcast.net with comcast id ixNr1g0081t3BNj8gxNsiY; Fri, 13 May 2011 09:22:52 +0000 Received: by icarus.home.lan (Postfix, from userid 1000) id 97436102C36; Fri, 13 May 2011 02:22:51 -0700 (PDT) Date: Fri, 13 May 2011 02:22:51 -0700 From: Jeremy Chadwick To: freebsd-ports-bugs@FreeBSD.org Message-ID: <20110513092251.GA27132@icarus.home.lan> References: <201105130910.p4D9ATZd079583@freefall.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201105130910.p4D9ATZd079583@freefall.freebsd.org> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: Olli Hauer , apache@FreeBSD.org Subject: Re: ports/156997: www/apache22 is vulnerable X-BeenThere: freebsd-apache@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Support of apache-related ports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 May 2011 09:22:54 -0000 On Fri, May 13, 2011 at 09:10:29AM +0000, edwin@FreeBSD.org wrote: > Synopsis: www/apache22 is vulnerable > > Responsible-Changed-From-To: freebsd-ports-bugs->apache > Responsible-Changed-By: edwin > Responsible-Changed-When: Fri May 13 09:10:28 UTC 2011 > Responsible-Changed-Why: > Over to maintainer (via the GNATS Auto Assign Tool) > > http://www.freebsd.org/cgi/query-pr.cgi?pr=156997 Note: this should probably be modified to refer to devel/apr* (I'm not sure which port; apr0, apr1, or apr2 -- or maybe all of them), which is what the Apache port relies on. The security hole appears to be in apr_fnmatch(), so ultimately what needs to be fixed is/are the apr port(s). https://lwn.net/Articles/442625/ -- | Jeremy Chadwick jdc@parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP 4BD6C0CB |