Publishing details

Changelog

apache2 (2.4.29-1ubuntu4.14) bionic-security; urgency=medium

  * SECURITY UPDATE: mod_rewrite redirect issue
    - debian/patches/CVE-2020-1927-1.patch: factor out default regex flags
      in include/ap_regex.h, server/core.c, server/util_pcre.c.
    - debian/patches/CVE-2020-1927-2.patch: add AP_REG_NO_DEFAULT to allow
      opt-out of pcre defaults in include/ap_regex.h,
      modules/filters/mod_substitute.c, server/util_pcre.c,
      server/util_regex.c.
    - CVE-2020-1927
  * SECURITY UPDATE: mod_proxy_ftp uninitialized memory issue
    - debian/patches/CVE-2020-1934.patch: trap bad FTP responses in
      modules/proxy/mod_proxy_ftp.c.
    - CVE-2020-1934
  * SECURITY UPDATE: DoS via invalid Cache-Digest header
    - debian/patches/CVE-2020-9490.patch: remove support for abandoned
      http-wg draft in modules/http2/h2_push.c, modules/http2/h2_push.h.
    - CVE-2020-9490
  * SECURITY UPDATE: concurrent use of memory pools in HTTP/2 module
    - debian/patches/CVE-2020-11993-pre1.patch: fixed rare cases where a h2
      worker could deadlock the main connection in modules/http2/*.
    - debian/patches/CVE-2020-11993.patch: fix logging and rename
      terminology in modules/http2/*.
    - CVE-2020-11993

 -- Marc Deslauriers <email address hidden>  Wed, 12 Aug 2020 17:33:25 -0400

Available diffs

Builds

Package files