meta-openembedded/meta-webserver
Li Wang aeae0a34cf apache2: fix CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641
CVE-2020-13950:
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be
made to crash (NULL pointer dereference) with specially crafted
requests using both Content-Length and Transfer-Encoding headers,
leading to a Denial of Service

References:
https://nvd.nist.gov/vuln/detail/CVE-2020-13950

Upstream patches:
https://bugzilla.redhat.com/show_bug.cgi?id=1966738
8c162db8b6

CVE-2020-35452:
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially
crafted Digest nonce can cause a stack overflow in
mod_auth_digest. There is no report of this overflow
being exploitable, nor the Apache HTTP Server team could
create one, though some particular compiler and/or
compilation option might make it possible, with limited
consequences anyway due to the size (a single byte) and
the value (zero byte) of the overflow

References:
https://nvd.nist.gov/vuln/detail/CVE-2020-35452

Upstream patches:
https://security-tracker.debian.org/tracker/CVE-2020-35452
3b6431eb9c

CVE-2021-26690:
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially
crafted Cookie header handled by mod_session can cause
a NULL pointer dereference and crash, leading to a
possible Denial Of Service

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-26690

Upstream patches:
https://security-tracker.debian.org/tracker/CVE-2021-26690
67bd9bfe6c

CVE-2021-26691:
In Apache HTTP Server versions 2.4.0 to 2.4.46 a
specially crafted SessionHeader sent by an origin server
could cause a heap overflow

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-26691

Upstream patches:
https://bugzilla.redhat.com/show_bug.cgi?id=1966732
7e09dd714f

CVE-2021-30641:
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected
matching behavior with 'MergeSlashes OFF'

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-30641

Upstream patches:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
6141d5aa3f

Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 70b1aa0a4c)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10 21:15:33 -07:00
..
conf layers: update LAYERSERIES_COMPAT to dunfell 2020-03-20 07:44:29 -07:00
licenses OML: move license file from meta-oe to meta-webserver 2016-01-04 14:56:23 +01:00
recipes-core packagegroup-meta-webserver: remove nostromo from pkg grp 2021-05-14 10:03:51 -07:00
recipes-httpd apache2: fix CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641 2021-07-10 21:15:33 -07:00
recipes-php xdebug: upgrade 2.7.2 -> 2.9.5 2020-04-27 07:48:46 -07:00
recipes-support spawn-fcgi: Clarify BSD license variant 2019-10-24 01:01:43 -07:00
recipes-webadmin netdata: Add libatomic to link step 2020-01-28 13:55:35 -08:00
COPYING.MIT Add meta-webserver layer 2012-10-03 13:34:32 +01:00
README README: updated Maintainers list for Dunfell 2020-05-05 16:47:34 -07:00

meta-webserver
==============

This layer provides support for building web servers, web-based
applications and related software.



Dependencies
------------

This layer depends on:

URI: git://github.com/openembedded/oe-core.git
subdirectory: meta
branch: dunfell
revision: HEAD

For some recipes, the meta-oe layer is required:

URI: git://github.com/openembedded/meta-oe.git
subdirectory: meta-oe
branch: dunfell
revision: HEAD



Layout
------

recipes-httpd/      Web servers
recipes-php/        PHP applications
recipes-support/    Miscellaneous support recipes
recipes-webadmin/   Standalone web administration interfaces


Notes
-----

* This layer used to provide a modphp recipe that built mod_php, but
  this is now built as part of the php recipe in meta-oe. However, since
  apache2 is required to build mod_php, and apache2 recipe is in this
  layer and recipes in meta-oe can't depend on it, mod_php is not built
  by default. If you do wish to use mod_php, you need to add "apache2"
  to the PACKAGECONFIG value for the php recipe in order to enable it.
  See here for info on how to do that:

  http://www.yoctoproject.org/docs/current/ref-manual/ref-manual.html#var-PACKAGECONFIG


Maintenance
-----------

Send patches / pull requests to openembedded-devel@lists.openembedded.org
with '[meta-webserver][dunfell]' in the subject.

dunfell Maintainer: Armin Kuster <akuster808@gmail.com>


License
-------

All metadata is MIT licensed unless otherwise stated. Source code included
in tree for individual recipes is under the LICENSE stated in each recipe
(.bb file) unless otherwise stated.

This README document is Copyright (C) 2012 Intel Corporation.