aboutsummaryrefslogtreecommitdiffstats
path: root/meta-webserver
AgeCommit message (Collapse)Author
2021-09-02apache2: upgrade 2.4.46 -> 2.4.48Changqing Li
Source: https://git.openembedded.org/meta-openembedded https://git.openembedded.org/meta-openembedded MR: 112869, 112835, 105131, 112702, 112829 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-webserver/recipes-httpd/apache2?id=ba016d73b5233a43ec6e398b45445d13ddaad745 ChangeID: f3ac0bc1005c94a694573b823c8f3f7d4a15360c Description: Apache2 2.4.x is an LTS version with bug and CVE fixes. https://downloads.apache.org/httpd/CHANGES_2.4.48 Includes these CVE fixes: 2.4.48 CVE-2021-31618 2.4.47 CVE-2020-13938 CVE-2020-11985 CVE-2021-33193 CVE-2019-17567 Drop these patches included in update: CVE-2020-13950.patch CVE-2020-35452.patch CVE-2021-26690.patch CVE-2021-26691.patch CVE-2021-30641.patch Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ba016d73b5233a43ec6e398b45445d13ddaad745) Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-08-21nginx: fix CVE-2021-3618Joe Slater
Source: meta-openembedded.ort MR: 112731 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-webserver/recipes-httpd/nginx?id=f92dbcc4c2723e6ff4e308c8a2e6dc228a6cd7d5 ChangeID: dd3295b606d73e01dd09291d85d529dea17a1a9e Description: Backport with no change a patch from version 1.21.0. This patch was not cherry-picked by nginx to version 1.20.1. Information about this CVE comes from https://ubuntu.com/security/CVE-2021-3618. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f92dbcc4c2723e6ff4e308c8a2e6dc228a6cd7d5) [refesh patch for Dunfell context] Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-07-24hiawatha: fix url.Armin Kuster
files moved under a new dir structure. ERROR: hiawatha-10.10-r0 do_fetch: Fetcher failure for URL: 'http://hiawatha-webserver.org/files/hiawatha-10.10.tar.gz'. Unable to fetch URL from any source. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10apache2: fix CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 ↵Li Wang
CVE-2021-30641 CVE-2020-13950: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service References: https://nvd.nist.gov/vuln/detail/CVE-2020-13950 Upstream patches: https://bugzilla.redhat.com/show_bug.cgi?id=1966738 https://github.com/apache/httpd/commit/8c162db8b65b2193e622b780e8c6516d4265f68b CVE-2020-35452: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow References: https://nvd.nist.gov/vuln/detail/CVE-2020-35452 Upstream patches: https://security-tracker.debian.org/tracker/CVE-2020-35452 https://github.com/apache/httpd/commit/3b6431eb9c9dba603385f70a2131ab4a01bf0d3b CVE-2021-26690: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service References: https://nvd.nist.gov/vuln/detail/CVE-2021-26690 Upstream patches: https://security-tracker.debian.org/tracker/CVE-2021-26690 https://github.com/apache/httpd/commit/67bd9bfe6c38831e14fe7122f1d84391472498f8 CVE-2021-26691: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow References: https://nvd.nist.gov/vuln/detail/CVE-2021-26691 Upstream patches: https://bugzilla.redhat.com/show_bug.cgi?id=1966732 https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b CVE-2021-30641: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' References: https://nvd.nist.gov/vuln/detail/CVE-2021-30641 Upstream patches: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641 https://github.com/apache/httpd/commit/6141d5aa3f5cf8f1b89472e7fdb66578810d0ae3 Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 70b1aa0a4cd4bfd08b6c8d36a76f9b7cf20d61a6) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10nginx: fix CVE-2021-23017Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 82385049035a3a4a81b18af099d2131b46802965) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14packagegroup-meta-webserver: remove nostromo from pkg grpArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14nostromo: Blacklist and exclude from world buildsArmin Kuster
Host site is dead. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12apache2: upgrade v2.4.43 -> v2.4.46Sakib Sajal
Source: meta-openembedded.org MR: 105034, 105034, 105124 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-webserver/recipes-httpd/apache2?h=gatesgarth&id=fc995b3cfed86850ce5ab1b70da1e31560ac350f ChangeID: 37b9f376c5e4b9a9355f867bac56454e2630d86c Description: Minor upgrade inluding bug and CVE fixes, namely: - CVE-2020-9490 - CVE-2020-11984 - CVE-2020-11993 Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fc995b3cfed86850ce5ab1b70da1e31560ac350f) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-28apache2: create log/run directory via pkg_postinstYi Zhao
The commit e789c3837ca8d65abb4bac29dc2e5c595c8ce05b tries to create log/run directory in initscript/systemd unit file. This is not a correct method. We should create them in pkg_postinst. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6f4d0dbfbc7d5ab8c5781379884f41d30cb6db25) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-20apache2: fix service start failChangqing Li
reproduce steps: 1. boot up target 2. scp apache2-2.4.41-r0.1.aarch64.rpm on target 3. rpm -i apache2-2.4.41-r0.1.aarch64.rpm 4. systemctl status apache2 Error: httpd[7767]: (2)No such file or directory: AH02291: Cannot access directory '/var/log/apache2/' for main error log with the old way, /var/log/apache2/ is created by service systemd-tmpfiles-setup during boot, so only works when apache2 already installed before boot, in above scenario, /var/log/apache2/ will not created. fix by creating it in the service file. similar fix for sysV system Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e789c3837ca8d65abb4bac29dc2e5c595c8ce05b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17nginx: remove /var/log/nginx when do_installYi Zhao
Remove directory /var/log/nginx when do_install because it is created by volatiles file. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6e9f393605eed1e5f4e317536b1463b83b978bad) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-05README: updated Maintainers list for DunfellArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-27xdebug: upgrade 2.7.2 -> 2.9.5Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17apache2: add patch ensuring destdir is empty stringTrevor Gamblin
apache2 added cross-compilation support after 2.4.41, but this conflicts with our own cross-compilation setup and causes related recipes like apache-websocket to fail to find config files (due to incorrect file paths) during build: | cannot open /ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot//usr/share/apache2/build/config_vars.mk: No such file or directory at /ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/usr/bin/crossscripts/apxs line 213. Add this patch to ensure that the $destdir variable used in apache2's cross-compilation scheme is always the empty string so that apache-websocket can find the right files. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17apache2: upgrade 2.4.41 -> 2.4.43Trevor Gamblin
LICENSE file was updated due to a typo fix. Note that this upgrade fixes two CVES affecting versions 2.4.41 and earlier: CVE: CVE-2020-1927 CVE: CVE-2020-1934 See: https://nvd.nist.gov/vuln/detail/CVE-2020-1927 https://nvd.nist.gov/vuln/detail/CVE-2020-1934 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01phpmyadmin: upgrade 4.9.2 -> 5.0.2Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01nostromo: upgrade 1.9.6 -> 1.9.7Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-03-20layers: update LAYERSERIES_COMPAT to dunfellKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-26nginx: fix error during service startupChangqing Li
fix below error: nginx.service: failed to parse pid from file /run/nginx/nginx.pid: invalid argument Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09nginx: update to the latest development version (1.17.8)Derek Straka
See Changelog: https://nginx.org/en/CHANGES Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09nginx: update to the latest stable version (1.16.1)Derek Straka
See changlog here: https://nginx.org/en/CHANGES-1.16 * Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-03hiawatha: upgrade 10.7 -> 10.10Pierre-Jean Texier
See full changelog https://www.hiawatha-webserver.org/changelog Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-28netdata: Add libatomic to link stepKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Replace using BBPATH with BBFILE_COLLECTIONS for meta-python2 checkKhem Raj
BBPATH check actually does not work Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22recipes: Turn inherit classes from meta-py2 to conditional constructsKhem Raj
helps parsing without meta-py2 in mix Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Only build with meta-py2 is in layermixKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Use python3 native during buildKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-12-13phpmyadmin: upgrade 4.9.1 -> 4.9.2Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-17nginx: fix install pathsGaylord Charles
This patch fixes Nginx install paths. I tried to build the native variant for testing purpose and had errors. - Use path variable instead of /usr - Replace the absolute path symlink with a relative one Signed-off-by: Gaylord CHARLES <gaylord.charles@veo-labs.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-13layer.conf: Add phpmyadmin->php dep to SIGGEN_EXCLUDE_SAFE_RECIPE_DEPSKhem Raj
phpmyadmin rdeps on php-cli but we can ignore signatures for the deps ERROR: phpmyadmin different signature for task do_package_write_ipk.sigdata Hash for dependent task php/php_7.3.11.bb:do_packagedata changed Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-11cherokee: Fix build when time_t is 64bitKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-10cherokee: Update to latestKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-24webmin: Clarify BSD license variantChristophe PRIOUZEAU
The License of webmin is BSD-3-Clause. Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-24spawn-fcgi: Clarify BSD license variantChristophe PRIOUZEAU
The License of spawn-fcgi is BSD-3-Clause. Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-08Add zeus compatibility to all layer.conf filesPalmer Dabbelt
I have no idea if this is the right thing to do, but without the patch I can't actually buil OE because none of these layers are compatible with the change in openembedded-core to move to zeus. Fixes: a5c9709b8d ("layer.conf: Update for zeus series") # openembedded-core Signed-off-by: Palmer Dabbelt <palmer@dabbelt.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-23phpmyadmin: upgrade 4.9.0.1 -> 4.9.1Yi Zhao
License-Update: tecnickcom/tcpdf/LICENSE.TXT: copyright years updated. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-10netdata: Update to 1.17.0 and fix build with clang/x86Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-10apache-websocket: fix module pathYi Zhao
The apache2 module's path has been changed from ${libdir} to ${libexecdir} in commit 8d4d608b4e937bb3b8e3b260bd75338c3ff7e8fd. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-05apache2: fix multilib file conflictsKai Kang
There are errors of apache2 about files conflicts when multilib enabled: | Error: Transaction check error: | file /etc/apache2/extra/httpd-ssl.conf conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64 | file /etc/apache2/httpd.conf conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64 | file /usr/sbin/envvars conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64 | file /usr/sbin/envvars-std conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64 It makes libexecdir point to ${libdir}. Reset to ${libexecdir} which could eliminate file conflicts of the conf files. And remove /usr/sbin/envvars and /usr/sbin/envvars-std which only used by apachectl. They only add standard library path ${libdir} to LD_LIBRARY_PATH, so remove them to avoid multilib file conflicts. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-08-20apache2: upgrade 2.4.39 -> 2.4.41Yi Zhao
Security fixes: CVE-2019-10081 CVE-2019-9517 CVE-2019-10098 CVE-2019-10092 CVE-2019-10097 CVE-2019-10082 See: http://www.apache.org/dist/httpd/CHANGES_2.4.41 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-08-17webmin: Add perl to rdeps for modulesKhem Raj
Fixes ERROR: webmin-1.850-r0 do_package_qa: QA Issue: /usr/libexec/webmin/ldap-client/stop.cgi contained in package webmin-module-ldap-client requires /usr/bin/perl, but no providers found in RDEPENDS_webmin-module-ldap-client? [file-rdeps] Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-08-02Netdata upgrade: 1.8.0 -> 1.16.0Luca Palano
Signed-off-by: Luca Palano <github@lpzone.it> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-07-21sthttpd: Use git SRC_URI instead of github archiveKhem Raj
Fixes SRC_URI uses unstable GitHub archives [src-uri-bad] Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-15phpmyadmin: upgrade 4.8.5 -> 4.9.0.1Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-15xdebug: upgrade 2.7.0RC2 -> 2.7.2Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-15fcgi: upgrade 2.4.1+git -> 2.4.2Yi Zhao
Remove add_foreign_to_AM_INIT_AUTOMAKE.patch as the issue had been fixed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27nginx: fix kill path in nginx systemd unit filenick83ola
the kill utility is located in /bin/kill -> use base_bindir instead of bindir Signed-off-by: Nicola Lunghi <nick83ola@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27nginx: add PACKAGECONFIG[http-auth-request]nick83ola
Signed-off-by: Nicola Lunghi <nick83ola@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27nginx: update stable version to 1.16.0nick83ola
The LIC_FILES_CHKSUM needs also to be updated due to the updated year in the LICENSE file - * Copyright (C) 2002-2018 Igor Sysoev - * Copyright (C) 2011-2018 Nginx, Inc. + * Copyright (C) 2002-2019 Igor Sysoev + * Copyright (C) 2011-2019 Nginx, Inc. Signed-off-by: Nicola Lunghi <nick83ola@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27nginx: update to version 1.17.0nick83ola
The LIC_FILES_CHKSUM needs also to be updated due to the updated year in the LICENSE file - * Copyright (C) 2002-2018 Igor Sysoev - * Copyright (C) 2011-2018 Nginx, Inc. + * Copyright (C) 2002-2019 Igor Sysoev + * Copyright (C) 2011-2019 Nginx, Inc. Signed-off-by: Nicola Lunghi <nick83ola@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-01 07:51:31 +0000