aboutsummaryrefslogtreecommitdiffstats
path: root/meta-webserver
AgeCommit message (Collapse)Author
2021-09-02apache2: upgrade 2.4.46 -> 2.4.48Changqing Li
Source: https://git.openembedded.org/meta-openembedded https://git.openembedded.org/meta-openembedded MR: 112869, 112835, 105131, 112702, 112829 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-webserver/recipes-httpd/apache2?id=ba016d73b5233a43ec6e398b45445d13ddaad745 ChangeID: f3ac0bc1005c94a694573b823c8f3f7d4a15360c Description: Apache2 2.4.x is an LTS version with bug and CVE fixes. https://downloads.apache.org/httpd/CHANGES_2.4.48 Includes these CVE fixes: 2.4.48 CVE-2021-31618 2.4.47 CVE-2020-13938 CVE-2020-11985 CVE-2021-33193 CVE-2019-17567 Drop these patches included in update: CVE-2020-13950.patch CVE-2020-35452.patch CVE-2021-26690.patch CVE-2021-26691.patch CVE-2021-30641.patch Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ba016d73b5233a43ec6e398b45445d13ddaad745) Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-07-24hiawatha: fix url.Armin Kuster
files moved under a new dir structure. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10apache2: fix CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 ↵Li Wang
CVE-2021-30641 CVE-2020-13950: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service References: https://nvd.nist.gov/vuln/detail/CVE-2020-13950 Upstream patches: https://bugzilla.redhat.com/show_bug.cgi?id=1966738 https://github.com/apache/httpd/commit/8c162db8b65b2193e622b780e8c6516d4265f68b CVE-2020-35452: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow References: https://nvd.nist.gov/vuln/detail/CVE-2020-35452 Upstream patches: https://security-tracker.debian.org/tracker/CVE-2020-35452 https://github.com/apache/httpd/commit/3b6431eb9c9dba603385f70a2131ab4a01bf0d3b CVE-2021-26690: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service References: https://nvd.nist.gov/vuln/detail/CVE-2021-26690 Upstream patches: https://security-tracker.debian.org/tracker/CVE-2021-26690 https://github.com/apache/httpd/commit/67bd9bfe6c38831e14fe7122f1d84391472498f8 CVE-2021-26691: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow References: https://nvd.nist.gov/vuln/detail/CVE-2021-26691 Upstream patches: https://bugzilla.redhat.com/show_bug.cgi?id=1966732 https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b CVE-2021-30641: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' References: https://nvd.nist.gov/vuln/detail/CVE-2021-30641 Upstream patches: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641 https://github.com/apache/httpd/commit/6141d5aa3f5cf8f1b89472e7fdb66578810d0ae3 Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10nginx: fix CVE-2021-23017Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-29packagegroup-meta-webserver: remove nostromo from pkg grpArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-29nostromo: Blacklist and exclude from world buildsArmin Kuster
Host site is dead. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-31README: updated Maintainers list for Hardknottakuster
Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-03-19layers: Drop gatesgarth from LAYERSERIES_COMPATKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-03-08phpmyadmin: upgrade 5.0.4 -> 5.1.0zhengruoqin
The following changes have taken place in copyright: -Copyright 2013 jQuery Foundation and other contributors -http://jquery.com/ +Copyright JS Foundation and other contributors, https://js.foundation/ Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-01-05phpmyadmin: 5.0.2 -> 5.0.4Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-12-30nginx: upgrade 1.17.8 -> 1.19.6changqing.li@windriver.com
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-12-30nginx: upgrade 1.16.1 -> 1.18.0changqing.li@windriver.com
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-12-03fcgiwrap: add recipeSenthil Selvaganesan
fcgiwrap is a simple server for running CGI applications over FastCGI. It hopes to provide clean CGI support to Nginx and other web servers that may need it. Homepage: https://github.com/gnosek/fcgiwrap. Signed-off-by: Senthil Selvaganesan <SenthilKumaran.Selvaganesan@garmin.com> Signed-off-by: Joshua Watt <Joshua.Watt@garmin.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04layer.conf: Add hardknott to LAYERSERIES_COMPATKhem Raj
Thats codename for 3.3 Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-10-15meta-openembedded: Add gatesgarth to LAYERSERIES_COMPATKhem Raj
Remove older releases from COMPAT Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-31monkey: Correct the install path in init servicesKhem Raj
Its not in bindir but in sbindir Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-31monkey: Remove /var/runKhem Raj
This is empty and its a runtime directory which is created by base-files already Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-31packagegroup-meta-webserver: Update to include new recipesKhem Raj
Re-organise to have one entry per line Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-26apache2: upgrade v2.4.43 -> v2.4.46Sakib Sajal
Minor upgrade inluding bug and CVE fixes, namely: - CVE-2020-9490 - CVE-2020-11984 - CVE-2020-11993 Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-13monkey: Upgrade to 1.6.9Khem Raj
Switch to using cmake Use CMake option to select musl support Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28nostromo: upgrade 1.9.7 -> 1.9.9Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28hiawatha: upgrade 10.10 -> 10.11Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28apache-websocket: upgrade 0.1.1 -> 0.1.2Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-06-19netdata: upgrade 1.17.0 -> 1.22.1Andreas Müller
* 0001-Correct-timeout-issue.patch: timeout is build by coreutils * 0002-Makefiles-does-not-build-contrib-dir.patch: Upstream added identical Signed-off-by: Andreas Müller <schnitzeltony@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-31spawn-fcgi: fix typo in SUMMARYKonrad Weihmann
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-30cockpit: 219 -> 220Michael Haener
Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-21apache2: create log/run directory via pkg_postinstYi Zhao
The commit e789c3837ca8d65abb4bac29dc2e5c595c8ce05b tries to create log/run directory in initscript/systemd unit file. This is not a correct method. We should create them in pkg_postinst. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-21cockpit: rt-deps for storagedMichael Haener
No general depdependency on udisks2 (polkit) Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-14cockpit: upgrade 218 -> 219Michael Haener
Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-14apache2: fix service start failChangqing Li
reproduce steps: 1. boot up target 2. scp apache2-2.4.41-r0.1.aarch64.rpm on target 3. rpm -i apache2-2.4.41-r0.1.aarch64.rpm 4. systemctl status apache2 Error: httpd[7767]: (2)No such file or directory: AH02291: Cannot access directory '/var/log/apache2/' for main error log with the old way, /var/log/apache2/ is created by service systemd-tmpfiles-setup during boot, so only works when apache2 already installed before boot, in above scenario, /var/log/apache2/ will not created. fix by creating it in the service file. similar fix for sysV system Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-11Cockpit: Added missing dependency on udisks2 for package cockpit-storagedJorge Solla
Cockpit uses udisks2 in order to manage storage on the host, without it cockpit will just display an error when the storage tab is selected. Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-06nginx: remove /var/log/nginx when do_installYi Zhao
Remove directory /var/log/nginx when do_install because it is created by volatiles file. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-04cockpit: fix metainfo.xml file ownershipEmmanuel Roullit
The 'tar -cf - | tar -xf' combo applies an invalid ownership. This is corrected by patching the install target to use the --no-same-owner tar parameter. Signed-off-by: Emmanuel Roullit <emmanuel.roullit@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-04cockpit: Add recipe version 218Michael Haener
Cockpit is a server manager that makes it easy to administer your GNU/Linux servers via a web browser. Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-27xdebug: upgrade 2.7.2 -> 2.9.5Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17apache2: add patch ensuring destdir is empty stringTrevor Gamblin
apache2 added cross-compilation support after 2.4.41, but this conflicts with our own cross-compilation setup and causes related recipes like apache-websocket to fail to find config files (due to incorrect file paths) during build: | cannot open /ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot//usr/share/apache2/build/config_vars.mk: No such file or directory at /ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/usr/bin/crossscripts/apxs line 213. Add this patch to ensure that the $destdir variable used in apache2's cross-compilation scheme is always the empty string so that apache-websocket can find the right files. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17apache2: upgrade 2.4.41 -> 2.4.43Trevor Gamblin
LICENSE file was updated due to a typo fix. Note that this upgrade fixes two CVES affecting versions 2.4.41 and earlier: CVE: CVE-2020-1927 CVE: CVE-2020-1934 See: https://nvd.nist.gov/vuln/detail/CVE-2020-1927 https://nvd.nist.gov/vuln/detail/CVE-2020-1934 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01phpmyadmin: upgrade 4.9.2 -> 5.0.2Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01nostromo: upgrade 1.9.6 -> 1.9.7Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-03-20layers: update LAYERSERIES_COMPAT to dunfellKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-26nginx: fix error during service startupChangqing Li
fix below error: nginx.service: failed to parse pid from file /run/nginx/nginx.pid: invalid argument Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09nginx: update to the latest development version (1.17.8)Derek Straka
See Changelog: https://nginx.org/en/CHANGES Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09nginx: update to the latest stable version (1.16.1)Derek Straka
See changlog here: https://nginx.org/en/CHANGES-1.16 * Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-03hiawatha: upgrade 10.7 -> 10.10Pierre-Jean Texier
See full changelog https://www.hiawatha-webserver.org/changelog Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-28netdata: Add libatomic to link stepKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Replace using BBPATH with BBFILE_COLLECTIONS for meta-python2 checkKhem Raj
BBPATH check actually does not work Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22recipes: Turn inherit classes from meta-py2 to conditional constructsKhem Raj
helps parsing without meta-py2 in mix Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Only build with meta-py2 is in layermixKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22cherokee: Use python3 native during buildKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-12-13phpmyadmin: upgrade 4.9.1 -> 4.9.2Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-27 22:53:32 +0000