gnu: httpd: Update to 2.4.25 [fixes CVE-2016-{0736,2161,5387,8743}].
* gnu/packages/web.scm (httpd): Update to 2.4.25. [source]: Remove obsolete patch 'httpd-CVE-2016-8740.patch'. * gnu/packages/patches/httpd-CVE-2016-8740.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it.
This commit is contained in:
		
							parent
							
								
									4a6b2a21bf
								
							
						
					
					
						commit
						a3df7e9f86
					
				
					 3 changed files with 2 additions and 41 deletions
				
			
		| 
						 | 
					@ -630,7 +630,6 @@ dist_patch_DATA =						\
 | 
				
			||||||
  %D%/packages/patches/hdf-eos5-fortrantests.patch		\
 | 
					  %D%/packages/patches/hdf-eos5-fortrantests.patch		\
 | 
				
			||||||
  %D%/packages/patches/higan-remove-march-native-flag.patch	\
 | 
					  %D%/packages/patches/higan-remove-march-native-flag.patch	\
 | 
				
			||||||
  %D%/packages/patches/hop-linker-flags.patch			\
 | 
					  %D%/packages/patches/hop-linker-flags.patch			\
 | 
				
			||||||
  %D%/packages/patches/httpd-CVE-2016-8740.patch			\
 | 
					 | 
				
			||||||
  %D%/packages/patches/hydra-disable-darcs-test.patch		\
 | 
					  %D%/packages/patches/hydra-disable-darcs-test.patch		\
 | 
				
			||||||
  %D%/packages/patches/hypre-doc-tables.patch			\
 | 
					  %D%/packages/patches/hypre-doc-tables.patch			\
 | 
				
			||||||
  %D%/packages/patches/hypre-ldflags.patch			\
 | 
					  %D%/packages/patches/hypre-ldflags.patch			\
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -1,36 +0,0 @@
 | 
				
			||||||
This patch applies against httpd-2.4.23 and shouldn't be needed in later releases
 | 
					 | 
				
			||||||
http://openwall.com/lists/oss-security/2016/12/05/17
 | 
					 | 
				
			||||||
Index: modules/http2/h2_stream.c
 | 
					 | 
				
			||||||
===================================================================
 | 
					 | 
				
			||||||
--- modules/http2/h2_stream.c	(revision 1771866)
 | 
					 | 
				
			||||||
+++ modules/http2/h2_stream.c	(working copy)
 | 
					 | 
				
			||||||
@@ -322,18 +322,18 @@
 | 
					 | 
				
			||||||
                                            HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
 | 
					 | 
				
			||||||
             }
 | 
					 | 
				
			||||||
         }
 | 
					 | 
				
			||||||
-    }
 | 
					 | 
				
			||||||
-    
 | 
					 | 
				
			||||||
-    if (h2_stream_is_scheduled(stream)) {
 | 
					 | 
				
			||||||
-        return h2_request_add_trailer(stream->request, stream->pool,
 | 
					 | 
				
			||||||
-                                      name, nlen, value, vlen);
 | 
					 | 
				
			||||||
-    }
 | 
					 | 
				
			||||||
-    else {
 | 
					 | 
				
			||||||
-        if (!input_open(stream)) {
 | 
					 | 
				
			||||||
-            return APR_ECONNRESET;
 | 
					 | 
				
			||||||
+        
 | 
					 | 
				
			||||||
+        if (h2_stream_is_scheduled(stream)) {
 | 
					 | 
				
			||||||
+            return h2_request_add_trailer(stream->request, stream->pool,
 | 
					 | 
				
			||||||
+                                          name, nlen, value, vlen);
 | 
					 | 
				
			||||||
         }
 | 
					 | 
				
			||||||
-        return h2_request_add_header(stream->request, stream->pool,
 | 
					 | 
				
			||||||
-                                     name, nlen, value, vlen);
 | 
					 | 
				
			||||||
+        else {
 | 
					 | 
				
			||||||
+            if (!input_open(stream)) {
 | 
					 | 
				
			||||||
+                return APR_ECONNRESET;
 | 
					 | 
				
			||||||
+            }
 | 
					 | 
				
			||||||
+            return h2_request_add_header(stream->request, stream->pool,
 | 
					 | 
				
			||||||
+                                         name, nlen, value, vlen);
 | 
					 | 
				
			||||||
+        }
 | 
					 | 
				
			||||||
     }
 | 
					 | 
				
			||||||
 }
 | 
					 | 
				
			||||||
 
 | 
					 | 
				
			||||||
| 
						 | 
					@ -88,16 +88,14 @@
 | 
				
			||||||
(define-public httpd
 | 
					(define-public httpd
 | 
				
			||||||
  (package
 | 
					  (package
 | 
				
			||||||
    (name "httpd")
 | 
					    (name "httpd")
 | 
				
			||||||
    (version "2.4.23")
 | 
					    (version "2.4.25")
 | 
				
			||||||
    (source (origin
 | 
					    (source (origin
 | 
				
			||||||
             (method url-fetch)
 | 
					             (method url-fetch)
 | 
				
			||||||
             (uri (string-append "mirror://apache/httpd/httpd-"
 | 
					             (uri (string-append "mirror://apache/httpd/httpd-"
 | 
				
			||||||
                                 version ".tar.bz2"))
 | 
					                                 version ".tar.bz2"))
 | 
				
			||||||
             (sha256
 | 
					             (sha256
 | 
				
			||||||
              (base32
 | 
					              (base32
 | 
				
			||||||
               "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))
 | 
					               "1cl0bkqg6srb1sypga0cn8dcmdyxldavij73zmmkxvlz3kgw4zpq"))))
 | 
				
			||||||
             (patches (search-patches "httpd-CVE-2016-8740.patch"))
 | 
					 | 
				
			||||||
             (patch-flags '("-p0"))))
 | 
					 | 
				
			||||||
    (build-system gnu-build-system)
 | 
					    (build-system gnu-build-system)
 | 
				
			||||||
    (native-inputs `(("pcre" ,pcre "bin")))       ;for 'pcre-config'
 | 
					    (native-inputs `(("pcre" ,pcre "bin")))       ;for 'pcre-config'
 | 
				
			||||||
    (inputs `(("apr" ,apr)
 | 
					    (inputs `(("apr" ,apr)
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Reference in a new issue