Publishing details

Changelog

apache2 (2.4.7-1ubuntu4.22) trusty-security; urgency=medium

  * SECURITY UPDATE: mod_session expiry time issue
    - debian/patches/CVE-2018-17199-pre1.patch: properly handle sessions
      that could not be decoded in modules/session/mod_session.c.
    - debian/patches/CVE-2018-17199.patch: always decode session attributes
      early in modules/session/mod_session.c.
    - CVE-2018-17199
  * SECURITY UPDATE: mod_auth_digest access control bypass
    - debian/patches/CVE-2019-0217.patch: fix a race condition in
      modules/aaa/mod_auth_digest.c.
    - CVE-2019-0217
  * SECURITY UPDATE: URL normalization inconsistincy
    - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
      the path in include/http_core.h, include/httpd.h, server/core.c,
      server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
      in server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
      server/util.c.
    - CVE-2019-0220

 -- Marc Deslauriers <email address hidden>  Wed, 03 Apr 2019 10:37:52 -0400

Available diffs

Builds

Built packages

Package files