Change log : apache2 package : Ubuntu

2.4.58-1ubuntu8.1

Published in oracular-proposed on 2024-04-29

Superseded in oracular-proposed on 2024-04-30

Published in noble-updates on 2024-04-29

Published in noble-security on 2024-04-29

apache2 (2.4.58-1ubuntu8.1) noble-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <email address hidden>  Thu, 18 Apr 2024 11:13:41 -0400

Available diffs

diff from 2.4.58-1ubuntu2 (in Ubuntu) to 2.4.58-1ubuntu8.1 (5.1 KiB)
diff from 2.4.58-1ubuntu8 (in Ubuntu) to 2.4.58-1ubuntu8.1 (4.4 KiB)

2.4.41-4ubuntu3.17

Published in focal-updates on 2024-04-11

Published in focal-security on 2024-04-11

apache2 (2.4.41-4ubuntu3.17) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <email address hidden>  Wed, 10 Apr 2024 13:46:26 -0400

Available diffs

diff from 2.4.41-4ubuntu3.16 (in Ubuntu) to 2.4.41-4ubuntu3.17 (4.4 KiB)
diff from 2.4.41-4ubuntu3.15 to 2.4.41-4ubuntu3.17 (5.1 KiB)

2.4.57-2ubuntu2.4

Published in mantic-updates on 2024-04-11

Published in mantic-security on 2024-04-11

apache2 (2.4.57-2ubuntu2.4) mantic-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <email address hidden>  Wed, 10 Apr 2024 13:41:02 -0400

Available diffs

diff from 2.4.57-2ubuntu2.3 (in Ubuntu) to 2.4.57-2ubuntu2.4 (4.4 KiB)
diff from 2.4.57-2ubuntu2.1 to 2.4.57-2ubuntu2.4 (5.2 KiB)

2.4.52-1ubuntu4.9

Published in jammy-updates on 2024-04-11

Published in jammy-security on 2024-04-11

apache2 (2.4.52-1ubuntu4.9) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <email address hidden>  Wed, 10 Apr 2024 13:45:18 -0400

Available diffs

diff from 2.4.52-1ubuntu4.8 (in Ubuntu) to 2.4.52-1ubuntu4.9 (4.4 KiB)
diff from 2.4.52-1ubuntu4.7 to 2.4.52-1ubuntu4.9 (5.1 KiB)

2.4.58-1ubuntu8

Published in oracular-release on 2024-04-29

Published in noble-release on 2024-04-12

Deleted in noble-proposed (Reason: Moved to noble)

apache2 (2.4.58-1ubuntu8) noble; urgency=medium

  * No-change rebuild against libapr1t64

 -- Steve Langasek <email address hidden>  Sun, 07 Apr 2024 07:02:29 +0000

Available diffs

diff from 2.4.58-1ubuntu7 to 2.4.58-1ubuntu8 (312 bytes)

2.4.58-1ubuntu7

Superseded in noble-release on 2024-04-12

Deleted in noble-proposed on 2024-04-13 (Reason: Moved to noble)

apache2 (2.4.58-1ubuntu7) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <email address hidden>  Sun, 31 Mar 2024 08:37:28 +0000

Available diffs

diff from 2.4.58-1ubuntu6 to 2.4.58-1ubuntu7 (343 bytes)

2.4.58-1ubuntu6

Superseded in noble-release on 2024-04-04

Deleted in noble-proposed on 2024-04-05 (Reason: Moved to noble)

apache2 (2.4.58-1ubuntu6) noble; urgency=medium

  * d/debhelper/apache2-maintscript-helper: Allow execution when called from a
    postinst script through a trigger (i.e., postinst triggered).
    Thanks to Roel van Meer. (LP: #2038912) (Closes: #1060450)

 -- Athos Ribeiro <email address hidden>  Mon, 18 Mar 2024 09:35:36 -0300

Available diffs

diff from 2.4.58-1ubuntu2 to 2.4.58-1ubuntu6 (1000 bytes)
diff from 2.4.58-1ubuntu5 to 2.4.58-1ubuntu6 (831 bytes)

2.4.58-1ubuntu5

Superseded in noble-proposed on 2024-03-20

apache2 (2.4.58-1ubuntu5) noble; urgency=medium

  * No-change rebuild against libcurl4t64

 -- Steve Langasek <email address hidden>  Sat, 16 Mar 2024 06:05:04 +0000

Available diffs

diff from 2.4.58-1ubuntu4 (in ~canonical-foundations/ubuntu/archive-bootstrap) to 2.4.58-1ubuntu5 (302 bytes)

2.4.58-1ubuntu4

Superseded in noble-proposed on 2024-03-16

apache2 (2.4.58-1ubuntu4) noble; urgency=medium

  * No-change rebuild against libaprutil1t64

 -- Zixing Liu <email address hidden>  Sat, 09 Mar 2024 23:05:43 -0700

Available diffs

diff from 2.4.58-1ubuntu3 (in Ubuntu) to 2.4.58-1ubuntu4 (310 bytes)

2.4.58-1ubuntu3

Superseded in noble-proposed on 2024-03-10

apache2 (2.4.58-1ubuntu3) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <email address hidden>  Mon, 04 Mar 2024 17:21:46 +0000

Available diffs

diff from 2.4.58-1ubuntu2 to 2.4.58-1ubuntu3 (344 bytes)

2.4.41-4ubuntu3.16

Superseded in focal-updates on 2024-04-11

Deleted in focal-proposed on 2024-04-12 (Reason: moved to -updates)

apache2 (2.4.41-4ubuntu3.16) focal; urgency=medium

  * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
    dolphin and Konqueror/5 careful redirection so that directories can be
    deleted via webdav.
    (LP: #1927742)

 -- Bryce Harrington <email address hidden>  Tue, 16 Jan 2024 19:00:27 -0800

Available diffs

2.4.57-2ubuntu2.3

Superseded in mantic-updates on 2024-04-11

Deleted in mantic-proposed on 2024-04-12 (Reason: moved to -updates)

apache2 (2.4.57-2ubuntu2.3) mantic; urgency=medium

  * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
    dolphin and Konqueror/5 careful redirection so that directories can be
    deleted via webdav.
    (LP: #1927742)

Available diffs

diff from 2.4.57-2ubuntu2.1 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.4.57-2ubuntu2.3 (1.1 KiB)
diff from 2.4.57-2ubuntu2.2 to 2.4.57-2ubuntu2.3 (1014 bytes)

2.4.52-1ubuntu4.8

Superseded in jammy-updates on 2024-04-11

Deleted in jammy-proposed on 2024-04-12 (Reason: moved to -updates)

apache2 (2.4.52-1ubuntu4.8) jammy; urgency=medium

  * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
    dolphin and Konqueror/5 careful redirection so that directories can be
    deleted via webdav.
    (LP: #1927742)

 -- Bryce Harrington <email address hidden>  Tue, 16 Jan 2024 19:00:18 -0800

Available diffs

2.4.58-1ubuntu2

Deleted in noble-updates on 2024-04-06 (Reason: superseded by release)

Superseded in noble-release on 2024-03-29

Deleted in noble-proposed on 2024-04-06 (Reason: Moved to noble)

apache2 (2.4.58-1ubuntu2) noble; urgency=medium

  * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
    dolphin and Konqueror/5 careful redirection so that directories can be
    deleted via webdav.
    (LP: #1927742)

 -- Bryce Harrington <email address hidden>  Wed, 24 Jan 2024 14:00:03 -0800

Available diffs

diff from 2.4.58-1ubuntu1 to 2.4.58-1ubuntu2 (993 bytes)

2.4.57-2ubuntu2.2

Superseded in mantic-proposed on 2024-02-07

apache2 (2.4.57-2ubuntu2.2) mantic; urgency=medium

  * d/icons/ubuntu-logo.png: add Ubuntu image for welcome page (LP: #1947459).

 -- Mitchell Dzurick <email address hidden>  Fri, 05 Jan 2024 14:39:55 -0700

Available diffs

diff from 2.4.57-2ubuntu2 to 2.4.57-2ubuntu2.2 (48.9 KiB)

2.4.58-1ubuntu1

Superseded in noble-release on 2024-02-01

Deleted in noble-proposed on 2024-02-02 (Reason: Moved to noble)

apache2 (2.4.58-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040357). Remaining changes:

    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)
    - d/control: Upgrade lua build dependency to 5.4

 -- Bryce Harrington <email address hidden>  Thu, 14 Dec 2023 23:52:39 -0800

Available diffs

diff from 2.4.57-2ubuntu3 to 2.4.58-1ubuntu1 (412.5 KiB)

2.4.57-2ubuntu3

Superseded in noble-release on 2023-12-16

Deleted in noble-proposed on 2024-01-10 (Reason: Moved to noble)

apache2 (2.4.57-2ubuntu3) noble; urgency=medium

  * d/icons/ubuntu-logo.png: add Ubuntu image for welcome page (LP: #1947459).
  * d/t/check-ubuntu-branding: add check for ubuntu branding.

 -- Mitchell Dzurick <email address hidden>  Mon, 13 Nov 2023 10:49:48 -0700

Available diffs

diff from 2.4.57-2ubuntu2 to 2.4.57-2ubuntu3 (1.0 KiB)

2.4.55-1ubuntu2.1

Published in lunar-updates on 2023-11-22

Published in lunar-security on 2023-11-22

apache2 (2.4.55-1ubuntu2.1) lunar-security; urgency=medium

  * SECURITY UPDATE: mod_macro buffer over-read
    - debian/patches/CVE-2023-31122.patch: fix length in
      modules/core/mod_macro.c.
    - CVE-2023-31122
  * SECURITY UPDATE: Multiple issues in HTTP/2
    - CVE-2023-43622: DoS in HTTP/2 with initial windows size 0
    - CVE-2023-45802: HTTP/2 stream memory not reclaimed right away on RST
    - debian/patches/update_http2.patch: backport version 2.0.22 of
      mod_http2 from httpd 2.4.58.
    - CVE-2023-43622
    - CVE-2023-45802

 -- Marc Deslauriers <email address hidden>  Thu, 26 Oct 2023 09:37:01 -0400

Available diffs

diff from 2.4.55-1ubuntu2 (in Ubuntu) to 2.4.55-1ubuntu2.1 (50.3 KiB)

2.4.52-1ubuntu4.7

Superseded in jammy-updates on 2024-03-13

Superseded in jammy-security on 2024-04-11

apache2 (2.4.52-1ubuntu4.7) jammy-security; urgency=medium

  * SECURITY UPDATE: mod_macro buffer over-read
    - debian/patches/CVE-2023-31122.patch: fix length in
      modules/core/mod_macro.c.
    - CVE-2023-31122
  * SECURITY UPDATE: Multiple issues in HTTP/2
    - CVE-2023-43622: DoS in HTTP/2 with initial windows size 0
    - CVE-2023-45802: HTTP/2 stream memory not reclaimed right away on RST
    - debian/patches/update_http2.patch: backport version 2.0.22 of
      mod_http2 from httpd 2.4.58.
    - CVE-2023-43622
    - CVE-2023-45802

 -- Marc Deslauriers <email address hidden>  Thu, 26 Oct 2023 09:44:44 -0400

Available diffs

diff from 2.4.52-1ubuntu4.6 (in Ubuntu) to 2.4.52-1ubuntu4.7 (218.9 KiB)
diff from 2.4.52-1ubuntu4.4 to 2.4.52-1ubuntu4.7 (220.3 KiB)

2.4.57-2ubuntu2.1

Superseded in mantic-updates on 2024-02-21

Superseded in mantic-security on 2024-04-11

apache2 (2.4.57-2ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: mod_macro buffer over-read
    - debian/patches/CVE-2023-31122.patch: fix length in
      modules/core/mod_macro.c.
    - CVE-2023-31122
  * SECURITY UPDATE: Multiple issues in HTTP/2
    - CVE-2023-43622: DoS in HTTP/2 with initial windows size 0
    - CVE-2023-45802: HTTP/2 stream memory not reclaimed right away on RST
    - debian/patches/update_http2.patch: backport version 2.0.22 of
      mod_http2 from httpd 2.4.58.
    - CVE-2023-43622
    - CVE-2023-45802

 -- Marc Deslauriers <email address hidden>  Thu, 26 Oct 2023 09:28:30 -0400

Available diffs

diff from 2.4.57-2ubuntu2 (in Ubuntu) to 2.4.57-2ubuntu2.1 (48.7 KiB)

2.4.41-4ubuntu3.15

Superseded in focal-updates on 2024-03-13

Superseded in focal-security on 2024-04-11

apache2 (2.4.41-4ubuntu3.15) focal-security; urgency=medium

  * SECURITY UPDATE: mod_macro buffer over-read
    - debian/patches/CVE-2023-31122.patch: fix length in
      modules/core/mod_macro.c.
    - CVE-2023-31122
  * SECURITY UPDATE: Multiple issues in HTTP/2
    - CVE-2023-43622: DoS in HTTP/2 with initial windows size 0
    - CVE-2023-45802: HTTP/2 stream memory not reclaimed right away on RST
    - debian/tests/run-test-suite: run with HARNESS_VERBOSE=1.
    - debian/patches/update_tests.patch: backport tests from jammy's
      2.4.52 to improve test coverage.
    - debian/patches/update_http2.patch: backport version 2.0.22 of
      mod_http2 from httpd 2.4.58.
    - CVE-2023-43622
    - CVE-2023-45802

 -- Marc Deslauriers <email address hidden>  Thu, 26 Oct 2023 09:54:09 -0400

Available diffs

diff from 2.4.41-4ubuntu3.14 to 2.4.41-4ubuntu3.15 (355.1 KiB)

2.4.57-2ubuntu2

Superseded in noble-release on 2023-11-19

Published in mantic-release on 2023-08-26

Deleted in mantic-proposed (Reason: Moved to mantic)

apache2 (2.4.57-2ubuntu2) mantic; urgency=medium

  * d/control: Upgrade lua build dependency to 5.4

 -- Lena Voytek <email address hidden>  Fri, 21 Jul 2023 14:17:42 -0700

Available diffs

diff from 2.4.57-2ubuntu1 to 2.4.57-2ubuntu2 (434 bytes)

2.4.54-2ubuntu1.5

Obsolete in kinetic-proposed on 2023-11-13

apache2 (2.4.54-2ubuntu1.5) kinetic; urgency=medium

  * d/p/reenable-workers-in-standard-error-state-kinetic-apache2.patch:
    fix the value discrepancy of MODULE_MAGIC_NUMBER_MINOR.
    (LP: #2003189)

 -- Michal Maloszewski <email address hidden>  Wed, 21 Jun 2023 17:41:40 +0200

Available diffs

diff from 2.4.54-2ubuntu1.4 to 2.4.54-2ubuntu1.5 (1.3 KiB)

2.4.57-2ubuntu1

Superseded in mantic-release on 2023-08-26

Deleted in mantic-proposed on 2023-08-27 (Reason: Moved to mantic)

apache2 (2.4.57-2ubuntu1) mantic; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries: Replace Debian with Ubuntu on default
      homepage.
    - d/apache2.py, d/apache2-bin.install: Add apport hook
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
  * Dropped changes included in new version:
    - debian/patches/CVE-2023-25690-1.patch
    - debian/patches/CVE-2023-25690-2.patch
    - debian/patches/CVE-2023-27522.patch

Available diffs

diff from 2.4.55-1ubuntu2 to 2.4.57-2ubuntu1 (89.9 KiB)

2.4.54-2ubuntu1.4

Superseded in kinetic-proposed on 2023-07-15

apache2 (2.4.54-2ubuntu1.4) kinetic; urgency=medium

  * d/p/reenable-workers-in-standard-error-state-kinetic-apache2.patch:
    fix issue with workers in apache2 which could not recover from its
    error state (LP: #2003189)

 -- Michal Maloszewski <email address hidden>  Wed, 03 May 2023 21:41:59 +0200

Available diffs

diff from 2.4.54-2ubuntu1.3 to 2.4.54-2ubuntu1.4 (1.5 KiB)

2.4.52-1ubuntu4.6

Superseded in jammy-updates on 2023-11-22

Deleted in jammy-proposed on 2024-01-10 (Reason: moved to -updates)

apache2 (2.4.52-1ubuntu4.6) jammy; urgency=medium

  * d/p/reenable-workers-in-standard-error-state-jammy-apache2.patch:
    fix issue with workers in apache2 which could not recover from its
    error state (LP: #2003189)

 -- Michal Maloszewski <email address hidden>  Wed, 03 May 2023 22:02:51 +0200

Available diffs

diff from 2.4.52-1ubuntu4.5 to 2.4.52-1ubuntu4.6 (1.5 KiB)

2.4.54-2ubuntu1.3

Obsolete in kinetic-updates on 2023-11-13

Deleted in kinetic-proposed on 2024-01-10 (Reason: moved to -updates)

apache2 (2.4.54-2ubuntu1.3) kinetic; urgency=medium

  * d/p/mod_proxy_hcheck_kinetic_fix_to_detect_support.patch: Fix issue
    where enabling mod_proxy_hcheck results in error (LP: #1998311)

 -- Michal Maloszewski <email address hidden>  Thu, 02 Mar 2023 00:01:26 +0100

Available diffs

2.4.52-1ubuntu4.5

Superseded in jammy-updates on 2023-08-02

Deleted in jammy-proposed on 2023-08-03 (Reason: moved to -updates)

apache2 (2.4.52-1ubuntu4.5) jammy; urgency=medium

  * d/p/mod_proxy_hcheck_jammy_fix_to_detect_support.patch: Fix issue
    where enabling mod_proxy_hcheck results in error (LP: #1998311)

 -- Michal Maloszewski <email address hidden>  Wed, 01 Mar 2023 23:43:55 +0100

Available diffs

2.4.52-1ubuntu4.4

Superseded in jammy-updates on 2023-04-27

Superseded in jammy-security on 2023-11-22

apache2 (2.4.52-1ubuntu4.4) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
    - debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
      strings in modules/http2/mod_proxy_http2.c,
      modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
      modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
      modules/proxy/mod_proxy_wstunnel.c.
    - debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
      modules/http2/mod_proxy_http2.c.
    - CVE-2023-25690
  * SECURITY UPDATE: mod_proxy_uwsgi HTTP response splitting
    - debian/patches/CVE-2023-27522.patch: stricter backend HTTP response
      parsing/validation in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2023-27522

 -- Marc Deslauriers <email address hidden>  Wed, 08 Mar 2023 12:32:01 -0500

Available diffs

diff from 2.4.52-1ubuntu4.3 to 2.4.52-1ubuntu4.4 (3.1 KiB)

2.4.41-4ubuntu3.14

Superseded in focal-updates on 2023-11-22

Superseded in focal-security on 2023-11-22

apache2 (2.4.41-4ubuntu3.14) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
    - debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
      strings in modules/http2/mod_proxy_http2.c,
      modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
      modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
      modules/proxy/mod_proxy_wstunnel.c.
    - debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
      modules/http2/mod_proxy_http2.c.
    - CVE-2023-25690
  * SECURITY UPDATE: mod_proxy_uwsgi HTTP response splitting
    - debian/patches/CVE-2023-27522.patch: stricter backend HTTP response
      parsing/validation in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2023-27522

 -- Marc Deslauriers <email address hidden>  Wed, 08 Mar 2023 12:32:54 -0500

Available diffs

diff from 2.4.41-4ubuntu3.13 to 2.4.41-4ubuntu3.14 (3.1 KiB)

2.4.54-2ubuntu1.2

Superseded in kinetic-updates on 2023-04-27

Obsolete in kinetic-security on 2023-11-13

apache2 (2.4.54-2ubuntu1.2) kinetic-security; urgency=medium

  * SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
    - debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
      strings in modules/http2/mod_proxy_http2.c,
      modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
      modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
      modules/proxy/mod_proxy_wstunnel.c.
    - debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
      modules/http2/mod_proxy_http2.c.
    - CVE-2023-25690
  * SECURITY UPDATE: mod_proxy_uwsgi HTTP response splitting
    - debian/patches/CVE-2023-27522.patch: stricter backend HTTP response
      parsing/validation in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2023-27522

 -- Marc Deslauriers <email address hidden>  Wed, 08 Mar 2023 12:31:20 -0500

Available diffs

diff from 2.4.54-2ubuntu1.1 to 2.4.54-2ubuntu1.2 (3.2 KiB)

2.4.29-1ubuntu4.27

Published in bionic-updates on 2023-03-09

Published in bionic-security on 2023-03-09

apache2 (2.4.29-1ubuntu4.27) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
    - debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
      strings in modules/http2/mod_proxy_http2.c,
      modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
      modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
      modules/proxy/mod_proxy_wstunnel.c.
    - debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
      modules/http2/mod_proxy_http2.c.
    - CVE-2023-25690

 -- Marc Deslauriers <email address hidden>  Wed, 08 Mar 2023 12:34:33 -0500

Available diffs

diff from 2.4.29-1ubuntu4.26 to 2.4.29-1ubuntu4.27 (1.9 KiB)

2.4.55-1ubuntu2

Superseded in mantic-release on 2023-06-08

Published in lunar-release on 2023-03-14

Deleted in lunar-proposed (Reason: Moved to lunar)

apache2 (2.4.55-1ubuntu2) lunar; urgency=medium

  * SECURITY UPDATE: HTTP request splitting with mod_rewrite and mod_proxy
    - debian/patches/CVE-2023-25690-1.patch: don't forward invalid query
      strings in modules/http2/mod_proxy_http2.c,
      modules/mappers/mod_rewrite.c, modules/proxy/mod_proxy_ajp.c,
      modules/proxy/mod_proxy_balancer.c, modules/proxy/mod_proxy_http.c,
      modules/proxy/mod_proxy_wstunnel.c.
    - debian/patches/CVE-2023-25690-2.patch: Fix missing APLOGNO in
      modules/http2/mod_proxy_http2.c.
    - CVE-2023-25690
  * SECURITY UPDATE: mod_proxy_uwsgi HTTP response splitting
    - debian/patches/CVE-2023-27522.patch: stricter backend HTTP response
      parsing/validation in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2023-27522

 -- Marc Deslauriers <email address hidden>  Wed, 08 Mar 2023 11:32:34 -0500

Available diffs

diff from 2.4.55-1ubuntu1 to 2.4.55-1ubuntu2 (3.3 KiB)

2.4.29-1ubuntu4.26

Superseded in bionic-updates on 2023-03-09

Superseded in bionic-security on 2023-03-09

apache2 (2.4.29-1ubuntu4.26) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS via crafted If header in mod_dav
    - debian/patches/CVE-2006-20001.patch: fix error path for "Not" prefix
      parsing in modules/dav/main/util.c.
    - CVE-2006-20001
  * SECURITY UPDATE: request smuggling in mod_proxy_ajp
    - debian/patches/CVE-2022-36760.patch: cleanup on error in
      modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-36760
  * SECURITY UPDATE: response header truncation issue
    - debian/patches/CVE-2022-37436.patch: fail on bad header in
      modules/proxy/mod_proxy_http.c.
    - CVE-2022-37436

 -- Marc Deslauriers <email address hidden>  Tue, 31 Jan 2023 09:01:53 -0500

Available diffs

diff from 2.4.29-1ubuntu4.25 to 2.4.29-1ubuntu4.26 (2.5 KiB)

2.4.41-4ubuntu3.13

Superseded in focal-updates on 2023-03-09

Superseded in focal-security on 2023-03-09

apache2 (2.4.41-4ubuntu3.13) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via crafted If header in mod_dav
    - debian/patches/CVE-2006-20001.patch: fix error path for "Not" prefix
      parsing in modules/dav/main/util.c.
    - CVE-2006-20001
  * SECURITY UPDATE: request smuggling in mod_proxy_ajp
    - debian/patches/CVE-2022-36760.patch: cleanup on error in
      modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-36760
  * SECURITY UPDATE: response header truncation issue
    - debian/patches/CVE-2022-37436.patch: fail on bad header in
      modules/proxy/mod_proxy_http.c, server/protocol.c.
    - CVE-2022-37436

 -- Marc Deslauriers <email address hidden>  Mon, 23 Jan 2023 13:36:09 -0500

Available diffs

diff from 2.4.41-4ubuntu3.12 to 2.4.41-4ubuntu3.13 (2.9 KiB)

2.4.52-1ubuntu4.3

Superseded in jammy-updates on 2023-03-09

Superseded in jammy-security on 2023-03-09

apache2 (2.4.52-1ubuntu4.3) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via crafted If header in mod_dav
    - debian/patches/CVE-2006-20001.patch: fix error path for "Not" prefix
      parsing in modules/dav/main/util.c.
    - CVE-2006-20001
  * SECURITY UPDATE: request smuggling in mod_proxy_ajp
    - debian/patches/CVE-2022-36760.patch: cleanup on error in
      modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-36760
  * SECURITY UPDATE: response header truncation issue
    - debian/patches/CVE-2022-37436.patch: fail on bad header in
      modules/proxy/mod_proxy_http.c, server/protocol.c.
    - CVE-2022-37436

 -- Marc Deslauriers <email address hidden>  Mon, 23 Jan 2023 13:34:42 -0500

Available diffs

diff from 2.4.52-1ubuntu4.2 (in Ubuntu) to 2.4.52-1ubuntu4.3 (3.0 KiB)
diff from 2.4.52-1ubuntu4.1 to 2.4.52-1ubuntu4.3 (5.9 KiB)

2.4.54-2ubuntu1.1

Superseded in kinetic-updates on 2023-03-09

Superseded in kinetic-security on 2023-03-09

apache2 (2.4.54-2ubuntu1.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: DoS via crafted If header in mod_dav
    - debian/patches/CVE-2006-20001.patch: fix error path for "Not" prefix
      parsing in modules/dav/main/util.c.
    - CVE-2006-20001
  * SECURITY UPDATE: request smuggling in mod_proxy_ajp
    - debian/patches/CVE-2022-36760.patch: cleanup on error in
      modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-36760
  * SECURITY UPDATE: response header truncation issue
    - debian/patches/CVE-2022-37436.patch: fail on bad header in
      modules/proxy/mod_proxy_http.c, server/protocol.c.
    - CVE-2022-37436

 -- Marc Deslauriers <email address hidden>  Mon, 23 Jan 2023 13:25:54 -0500

Available diffs

diff from 2.4.54-2ubuntu1 (in Ubuntu) to 2.4.54-2ubuntu1.1 (3.1 KiB)

2.4.55-1ubuntu1

Superseded in lunar-release on 2023-03-14

Deleted in lunar-proposed on 2023-03-15 (Reason: Moved to lunar)

apache2 (2.4.55-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries: Replace Debian with Ubuntu on default
      homepage.
    - d/apache2.py, d/apache2-bin.install: Add apport hook
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles

Available diffs

diff from 2.4.54-3ubuntu2 to 2.4.55-1ubuntu1 (484.3 KiB)

2.4.54-3ubuntu2

Superseded in lunar-release on 2023-01-26

Deleted in lunar-proposed on 2023-01-28 (Reason: Moved to lunar)

apache2 (2.4.54-3ubuntu2) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <email address hidden>  Thu, 15 Dec 2022 19:42:31 +0000

Available diffs

diff from 2.4.54-3ubuntu1 to 2.4.54-3ubuntu2 (338 bytes)

2.4.54-3ubuntu1

Superseded in lunar-release on 2023-01-15

Deleted in lunar-proposed on 2023-01-16 (Reason: Moved to lunar)

apache2 (2.4.54-3ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993373). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries: Replace Debian with Ubuntu on default
      homepage.
      (LP #1966004)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)

 -- Bryce Harrington <email address hidden>  Wed, 16 Nov 2022 16:44:44 -0800

Available diffs

diff from 2.4.54-2ubuntu1 to 2.4.54-3ubuntu1 (1.1 KiB)

2.4.52-1ubuntu4.2

Superseded in jammy-updates on 2023-02-01

Deleted in jammy-proposed on 2023-02-02 (Reason: moved to -updates)

apache2 (2.4.52-1ubuntu4.2) jammy; urgency=medium

  * d/p/fix-a-possible-listener-deadlock.patch,
    d/p/handle-children-killed-pathologically.patch:  Fix situation
    where Apache fails to start its child processes after a certain
    number of requests, causing requests for new pages to hang.
    (LP: #1988224)
  * d/perl-framework/t/ssl/ocsp.t: Update test framework
    - Cherry pick from Debian 2.4.53-1

 -- Bryce Harrington <email address hidden>  Thu, 29 Sep 2022 21:09:50 -0700

Available diffs

2.4.54-2ubuntu1

Superseded in lunar-release on 2022-12-04

Obsolete in kinetic-release on 2023-11-13

Deleted in kinetic-proposed (Reason: Moved to kinetic)

apache2 (2.4.54-2ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1982048). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries: Replace Debian with Ubuntu on default
      homepage.
      (LP #1966004)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)

 -- Bryce Harrington <email address hidden>  Thu, 21 Jul 2022 19:38:00 +0000

Available diffs

diff from 2.4.53-2ubuntu1 to 2.4.54-2ubuntu1 (123.8 KiB)

2.4.29-1ubuntu4.25

Superseded in bionic-updates on 2023-02-01

Superseded in bionic-security on 2023-02-01

apache2 (2.4.29-1ubuntu4.25) bionic-security; urgency=medium

  * SECURITY REGRESSION: Previous fix for CVE-2022-30522 caused
    a regression
    - debian/patches/CVE-2022-30522.patch: removing line should be removed
      at the backport but was missing in modules/filters/sed1.c (LP: #1979641)

 -- Leonidas Da Silva Barbosa <email address hidden>  Thu, 23 Jun 2022 09:51:37 -0300

Available diffs

diff from 2.4.29-1ubuntu4.24 to 2.4.29-1ubuntu4.25 (1.7 KiB)

2.4.29-1ubuntu4.24

Superseded in bionic-updates on 2022-06-23

Superseded in bionic-security on 2022-06-23

apache2 (2.4.29-1ubuntu4.24) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2022-26377.patch: changing
      precedence between T-E and C-L in modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-26377
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28614.patch: handle large
      writes in ap_rputs.
      in server/util.c.
    - CVE-2022-28614
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28615.patch: fix types
      in server/util.c.
    - CVE-2022-28615
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-29404.patch: cast first
      in modules/lua/lua_request.c.
    - CVE-2022-29404
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-30522.patch: limit mod_sed
      memory use in modules/filters/mod_sec.c,
      modules/filters/sed1.c.
    - CVE-2022-30522
  * SECURITY UPDATE: Returning point past of the buffer
    - debian/patches/CVE-2022-30556.patch: use filters consistently
      in modules/lua/lua_request.c.
    - CVE-2022-30556
  * SECURITY UPDATE: Bypass IP authentication
    - debian/patches/CVE-2022-31813.patch: to clear
      hop-by-hop first and fixup last in modules/proxy/proxy_util.c.
    - CVE-2022-31813

 -- Leonidas Da Silva Barbosa <email address hidden>  Tue, 14 Jun 2022 14:52:48 -0300

Available diffs

diff from 2.4.29-1ubuntu4.23 (in Ubuntu) to 2.4.29-1ubuntu4.24 (10.7 KiB)
diff from 2.4.29-1ubuntu4.22 to 2.4.29-1ubuntu4.24 (11.9 KiB)

2.4.41-4ubuntu3.12

Superseded in focal-updates on 2023-02-01

Superseded in focal-security on 2023-02-01

apache2 (2.4.41-4ubuntu3.12) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2022-26377.patch: changing
      precedence between T-E and C-L in modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-26377
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28614.patch: handle large
      writes in ap_rputs.
      in server/util.c.
    - CVE-2022-28614
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28615.patch: fix types
      in server/util.c.
    - CVE-2022-28615
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-29404.patch: cast first
      in modules/lua/lua_request.c.
    - CVE-2022-29404
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-30522.patch: limit mod_sed
      memory use in modules/filters/mod_sec.c,
      modules/filters/sed1.c.
    - CVE-2022-30522
  * SECURITY UPDATE: Returning point past of the buffer
    - debian/patches/CVE-2022-30556.patch: use filters consistently
      in modules/lua/lua_request.c.
    - CVE-2022-30556
  * SECURITY UPDATE: Bypass IP authentication
    - debian/patches/CVE-2022-31813.patch: to clear
      hop-by-hop first and fixup last in modules/proxy/proxy_util.c.
    - CVE-2022-31813

 -- Leonidas Da Silva Barbosa <email address hidden>  Tue, 14 Jun 2022 10:30:55 -0300

Available diffs

diff from 2.4.41-4ubuntu3.11 (in Ubuntu) to 2.4.41-4ubuntu3.12 (10.6 KiB)
diff from 2.4.41-4ubuntu3.10 to 2.4.41-4ubuntu3.12 (11.9 KiB)

2.4.52-1ubuntu4.1

Superseded in jammy-updates on 2022-11-16

Superseded in jammy-security on 2023-02-01

apache2 (2.4.52-1ubuntu4.1) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2022-26377.patch: changing
      precedence between T-E and C-L in modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-26377
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28614.patch: handle large
      writes in ap_rputs.
      in server/util.c.
    - CVE-2022-28614
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28615.patch: fix types
      in server/util.c.
    - CVE-2022-28615
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-29404.patch: cast first
      in modules/lua/lua_request.c.
    - CVE-2022-29404
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-30522.patch: limit mod_sed
      memory use in modules/filters/mod_sec.c,
      modules/filters/sed1.c.
    - CVE-2022-30522
  * SECURITY UPDATE: Returning point past of the buffer
    - debian/patches/CVE-2022-30556.patch: use filters consitently
      in modules/lua/lua_request.c.
    - CVE-2022-30556
  * SECURITY UPDATE: Bypass IP authentication
    - debian/patches/CVE-2022-31813.patch: to clear
      hop-by-hop first and fixup last in modules/proxy/proxy_util.c.
    - CVE-2022-31813

 -- Leonidas Da Silva Barbosa <email address hidden>  Tue, 14 Jun 2022 09:30:21 -0300

Available diffs

diff from 2.4.52-1ubuntu4 (in Ubuntu) to 2.4.52-1ubuntu4.1 (10.7 KiB)

2.4.48-3.1ubuntu3.5

Obsolete in impish-updates on 2022-07-23

Obsolete in impish-security on 2022-07-23

apache2 (2.4.48-3.1ubuntu3.5) impish-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2022-26377.patch: changing
      precedence between T-E and C-L in modules/proxy/mod_proxy_ajp.c.
    - CVE-2022-26377
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28614.patch: handle large
      writes in ap_rputs.
      in server/util.c.
    - CVE-2022-28614
  * SECURITY UPDATE: Read beyond bounds
    - debian/patches/CVE-2022-28615.patch: fix types
      in server/util.c.
    - CVE-2022-28615
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-29404.patch: cast first
      in modules/lua/lua_request.c.
    - CVE-2022-29404
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-30522.patch: limit mod_sed
      memory use in modules/filters/mod_sec.c,
      modules/filters/sed1.c.
    - CVE-2022-30522
  * SECURITY UPDATE: Returning point past of the buffer
    - debian/patches/CVE-2022-30556.patch: use filters consitently
      in modules/lua/lua_request.c.
    - CVE-2022-30556
  * SECURITY UPDATE: Bypass IP authentication
    - debian/patches/CVE-2022-31813.patch: to clear
      hop-by-hop first and fixup last in modules/proxy/proxy_util.c.
    - CVE-2022-31813

 -- Leonidas Da Silva Barbosa <email address hidden>  Tue, 14 Jun 2022 09:33:28 -0300

Available diffs

diff from 2.4.48-3.1ubuntu3.4 (in Ubuntu) to 2.4.48-3.1ubuntu3.5 (10.7 KiB)
diff from 2.4.48-3.1ubuntu3.3 to 2.4.48-3.1ubuntu3.5 (12.0 KiB)

2.4.53-2ubuntu1

Superseded in kinetic-release on 2022-07-24

Deleted in kinetic-proposed on 2022-07-25 (Reason: Moved to kinetic)

apache2 (2.4.53-2ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971248). Remaining changes:
    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.
      (LP 261198)
    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
      (LP 609177)
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/s/include-binaries: replace Debian with Ubuntu on default
      page and add Ubuntu icon file.
      (LP 1288690)
    - d/index.html, d/icons/ubuntu-logo.png:  Refresh page design and
      new logo
      (LP 1966004)
    - d/apache2.postrm: Include md5 sum for updated index.html
  * Dropped:
    - OOB read in mod_lua via crafted request body
      + d/p/CVE-2022-22719.patch: error out if lua_read_body() or
        lua_write_body() fail in modules/lua/lua_request.c.
      [Fixed in 2.4.53 upstream]
    - HTTP Request Smuggling via error discarding the
      request body
      + d/p/CVE-2022-22720.patch: simpler connection close logic
        if discarding the request body fails in modules/http/http_filters.c,
        server/protocol.c.
      [Fixed in 2.4.53 upstream]
    - overflow via large LimitXMLRequestBody
      + d/p/CVE-2022-22721.patch: make sure and check that
        LimitXMLRequestBody fits in system memory in server/core.c,
        server/util.c, server/util_xml.c.
      [Fixed in 2.4.53 upstream]
    - out-of-bounds write in mod_sed
      + d/p/CVE-2022-23943-1.patch: use size_t to allow for larger
        buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
        modules/filters/mod_sed.c, modules/filters/sed1.c.
      + d/p/CVE-2022-23943-2.patch: improve the logic flow in
        modules/filters/mod_sed.c.
      [Fixed in 2.4.53 upstream]

 -- Bryce Harrington <email address hidden>  Mon, 23 May 2022 19:34:18 -0700

Available diffs

diff from 2.4.52-1ubuntu4 to 2.4.53-2ubuntu1 (297.9 KiB)

2.4.48-3.1ubuntu3.4

Superseded in impish-updates on 2022-06-21

Deleted in impish-proposed on 2022-06-22 (Reason: moved to -updates)

apache2 (2.4.48-3.1ubuntu3.4) impish; urgency=medium

  * d/p/mod_http2-Don-t-send-GOAWAY-too-early-when-MaxReques.patch:
    Don't send GOAWAY too early on new connections when
    MaxRequestsPerChild has been reached.  (LP: #1969629)

 -- Sergio Durigan Junior <email address hidden>  Tue, 26 Apr 2022 15:55:37 -0400

Available diffs

2.4.41-4ubuntu3.11

Superseded in focal-updates on 2022-06-21

Deleted in focal-proposed on 2022-06-22 (Reason: moved to -updates)

apache2 (2.4.41-4ubuntu3.11) focal; urgency=medium

  * d/p/mod_http2-Don-t-send-GOAWAY-too-early-when-MaxReques.patch:
    Don't send GOAWAY too early on new connections when
    MaxRequestsPerChild has been reached.  (LP: #1969629)

 -- Sergio Durigan Junior <email address hidden>  Tue, 26 Apr 2022 14:02:11 -0400

Available diffs

2.4.29-1ubuntu4.23

Superseded in bionic-updates on 2022-06-21

Deleted in bionic-proposed on 2022-06-22 (Reason: moved to -updates)

apache2 (2.4.29-1ubuntu4.23) bionic; urgency=medium

  * d/p/mod_http2-Don-t-send-GOAWAY-too-early-when-MaxReques.patch:
    Don't send GOAWAY too early on new connections when
    MaxRequestsPerChild has been reached.  (LP: #1969629)

 -- Sergio Durigan Junior <email address hidden>  Mon, 25 Apr 2022 20:46:43 -0400

Available diffs

2.4.52-1ubuntu4

Superseded in kinetic-release on 2022-06-08

Published in jammy-release on 2022-04-01

Deleted in jammy-proposed (Reason: Moved to jammy)

apache2 (2.4.52-1ubuntu4) jammy; urgency=medium

  * d/apache2.postrm: Include md5 sum for updated index.html

 -- Bryce Harrington <email address hidden>  Thu, 24 Mar 2022 17:35:40 -0700

Available diffs

diff from 2.4.52-1ubuntu2 to 2.4.52-1ubuntu4 (2.8 KiB)
diff from 2.4.52-1ubuntu3 to 2.4.52-1ubuntu4 (467 bytes)

2.4.52-1ubuntu3

Superseded in jammy-proposed on 2022-03-25

apache2 (2.4.52-1ubuntu3) jammy; urgency=medium

  * d/index.html:
    - Redesign page's heading for the new logo
    - Use the Ubuntu font where available
    - Update service management directions
    - Copyedit grammar
    - Light reformatting and whitespace cleanup
  * d/icons/ubuntu-logo.png: Refresh ubuntu logo
    (LP: #1966004)

 -- Bryce Harrington <email address hidden>  Wed, 23 Mar 2022 16:18:11 -0700

Available diffs

diff from 2.4.52-1ubuntu2 to 2.4.52-1ubuntu3 (2.6 KiB)

2.4.52-1ubuntu2

Superseded in jammy-release on 2022-04-01

Deleted in jammy-proposed on 2022-04-02 (Reason: Moved to jammy)

apache2 (2.4.52-1ubuntu2) jammy; urgency=medium

  * SECURITY UPDATE: OOB read in mod_lua via crafted request body
    - debian/patches/CVE-2022-22719.patch: error out if lua_read_body() or
      lua_write_body() fail in modules/lua/lua_request.c.
    - CVE-2022-22719
  * SECURITY UPDATE: HTTP Request Smuggling via error discarding the
    request body
    - debian/patches/CVE-2022-22720.patch: simpler connection close logic
      if discarding the request body fails in modules/http/http_filters.c,
      server/protocol.c.
    - CVE-2022-22720
  * SECURITY UPDATE: overflow via large LimitXMLRequestBody
    - debian/patches/CVE-2022-22721.patch: make sure and check that
      LimitXMLRequestBody fits in system memory in server/core.c,
      server/util.c, server/util_xml.c.
    - CVE-2022-22721
  * SECURITY UPDATE: out-of-bounds write in mod_sed
    - debian/patches/CVE-2022-23943-1.patch: use size_t to allow for larger
      buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
      modules/filters/mod_sed.c, modules/filters/sed1.c.
    - debian/patches/CVE-2022-23943-2.patch: improve the logic flow in
      modules/filters/mod_sed.c.
    - CVE-2022-23943

 -- Marc Deslauriers <email address hidden>  Thu, 17 Mar 2022 09:39:54 -0400

Available diffs

diff from 2.4.52-1ubuntu1 to 2.4.52-1ubuntu2 (8.1 KiB)

2.4.41-4ubuntu3.10

Superseded in focal-updates on 2022-05-30

Superseded in focal-security on 2022-06-21

apache2 (2.4.41-4ubuntu3.10) focal-security; urgency=medium

  * SECURITY UPDATE: OOB read in mod_lua via crafted request body
    - debian/patches/CVE-2022-22719.patch: error out if lua_read_body() or
      lua_write_body() fail in modules/lua/lua_request.c.
    - CVE-2022-22719
  * SECURITY UPDATE: HTTP Request Smuggling via error discarding the
    request body
    - debian/patches/CVE-2022-22720.patch: simpler connection close logic
      if discarding the request body fails in modules/http/http_filters.c,
      server/protocol.c.
    - CVE-2022-22720
  * SECURITY UPDATE: overflow via large LimitXMLRequestBody
    - debian/patches/CVE-2022-22721.patch: make sure and check that
      LimitXMLRequestBody fits in system memory in server/core.c,
      server/util.c, server/util_xml.c.
    - CVE-2022-22721
  * SECURITY UPDATE: out-of-bounds write in mod_sed
    - debian/patches/CVE-2022-23943-1.patch: use size_t to allow for larger
      buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
      modules/filters/mod_sed.c, modules/filters/sed1.c.
    - debian/patches/CVE-2022-23943-2.patch: improve the logic flow in
      modules/filters/mod_sed.c.
    - CVE-2022-23943

 -- Marc Deslauriers <email address hidden>  Wed, 16 Mar 2022 12:52:53 -0400

Available diffs

diff from 2.4.41-4ubuntu3.9 to 2.4.41-4ubuntu3.10 (8.1 KiB)

2.4.29-1ubuntu4.22

Superseded in bionic-updates on 2022-05-30

Superseded in bionic-security on 2022-06-21

apache2 (2.4.29-1ubuntu4.22) bionic-security; urgency=medium

  * SECURITY UPDATE: OOB read in mod_lua via crafted request body
    - debian/patches/CVE-2022-22719.patch: error out if lua_read_body() or
      lua_write_body() fail in modules/lua/lua_request.c.
    - CVE-2022-22719
  * SECURITY UPDATE: HTTP Request Smuggling via error discarding the
    request body
    - debian/patches/CVE-2022-22720.patch: simpler connection close logic
      if discarding the request body fails in modules/http/http_filters.c,
      server/protocol.c.
    - CVE-2022-22720
  * SECURITY UPDATE: overflow via large LimitXMLRequestBody
    - debian/patches/CVE-2022-22721.patch: make sure and check that
      LimitXMLRequestBody fits in system memory in server/core.c,
      server/util.c, server/util_xml.c.
    - CVE-2022-22721
  * SECURITY UPDATE: out-of-bounds write in mod_sed
    - debian/patches/CVE-2022-23943-1.patch: use size_t to allow for larger
      buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
      modules/filters/mod_sed.c, modules/filters/sed1.c.
    - debian/patches/CVE-2022-23943-2.patch: improve the logic flow in
      modules/filters/mod_sed.c.
    - CVE-2022-23943

 -- Marc Deslauriers <email address hidden>  Wed, 16 Mar 2022 12:53:42 -0400

Available diffs

diff from 2.4.29-1ubuntu4.21 to 2.4.29-1ubuntu4.22 (8.0 KiB)

2.4.48-3.1ubuntu3.3

Superseded in impish-updates on 2022-05-30

Superseded in impish-security on 2022-06-21

apache2 (2.4.48-3.1ubuntu3.3) impish-security; urgency=medium

  * SECURITY UPDATE: OOB read in mod_lua via crafted request body
    - debian/patches/CVE-2022-22719.patch: error out if lua_read_body() or
      lua_write_body() fail in modules/lua/lua_request.c.
    - CVE-2022-22719
  * SECURITY UPDATE: HTTP Request Smuggling via error discarding the
    request body
    - debian/patches/CVE-2022-22720.patch: simpler connection close logic
      if discarding the request body fails in modules/http/http_filters.c,
      server/protocol.c.
    - CVE-2022-22720
  * SECURITY UPDATE: overflow via large LimitXMLRequestBody
    - debian/patches/CVE-2022-22721.patch: make sure and check that
      LimitXMLRequestBody fits in system memory in server/core.c,
      server/util.c, server/util_xml.c.
    - CVE-2022-22721
  * SECURITY UPDATE: out-of-bounds write in mod_sed
    - debian/patches/CVE-2022-23943-1.patch: use size_t to allow for larger
      buffer sizes and unsigned arithmetics in modules/filters/libsed.h,
      modules/filters/mod_sed.c, modules/filters/sed1.c.
    - debian/patches/CVE-2022-23943-2.patch: improve the logic flow in
      modules/filters/mod_sed.c.
    - CVE-2022-23943

 -- Marc Deslauriers <email address hidden>  Wed, 16 Mar 2022 12:46:16 -0400

Available diffs

diff from 2.4.48-3.1ubuntu3.2 to 2.4.48-3.1ubuntu3.3 (8.1 KiB)

2.4.52-1ubuntu1

Superseded in jammy-release on 2022-03-22

Deleted in jammy-proposed on 2022-03-23 (Reason: Moved to jammy)

apache2 (2.4.52-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1959924). Remaining changes:
    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.
      (LP 261198)
    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
      (LP 609177)
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/s/include-binaries: replace Debian with Ubuntu on default
      page and add Ubuntu icon file.
      (LP 1288690)
  * Dropped:
    - d/p/support-openssl3-*.patch: Backport various patches from
      https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
      failure to load when using OpenSSL 3.
      (LP #1951476)
      [Included in upstream release 2.4.52]
    - d/apache2ctl: Also use systemd for graceful if it is in use.
      (LP 1832182)
      [This introduced a performance regression.]
    - d/apache2ctl: Also use /run/systemd to check for systemd usage.
      (LP 1918209)
      [Not needed]

 -- Bryce Harrington <email address hidden>  Thu, 03 Feb 2022 10:25:47 -0800

Available diffs

diff from 2.4.51-2ubuntu1 to 2.4.52-1ubuntu1 (714.5 KiB)

2.4.29-1ubuntu4.21

Superseded in bionic-updates on 2022-03-17

Superseded in bionic-security on 2022-03-17

apache2 (2.4.29-1ubuntu4.21) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS or SSRF via forward proxy
    - debian/patches/CVE-2021-44224-1.patch: enforce that fully qualified
      uri-paths not to be forward-proxied have an http(s) scheme, and that
      the ones to be forward proxied have a hostname in
      include/http_protocol.h, modules/http/http_request.c,
      modules/http2/h2_request.c, modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c, server/protocol.c.
    - debian/patches/CVE-2021-44224-2.patch: don't prevent forwarding URIs
      w/ no hostname in modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c.
    - CVE-2021-44224
  * SECURITY UPDATE: overflow in mod_lua multipart parser
    - debian/patches/CVE-2021-44790.patch: improve error handling in
      modules/lua/lua_request.c.
    - CVE-2021-44790

 -- Marc Deslauriers <email address hidden>  Wed, 05 Jan 2022 09:50:41 -0500

Available diffs

diff from 2.4.29-1ubuntu4.20 (in Ubuntu) to 2.4.29-1ubuntu4.21 (4.8 KiB)
diff from 2.4.29-1ubuntu4.18 to 2.4.29-1ubuntu4.21 (5.1 KiB)

2.4.41-4ubuntu3.9

Superseded in focal-updates on 2022-03-17

Superseded in focal-security on 2022-03-17

apache2 (2.4.41-4ubuntu3.9) focal-security; urgency=medium

  * SECURITY UPDATE: DoS or SSRF via forward proxy
    - debian/patches/CVE-2021-44224-1.patch: enforce that fully qualified
      uri-paths not to be forward-proxied have an http(s) scheme, and that
      the ones to be forward proxied have a hostname in
      include/http_protocol.h, modules/http/http_request.c,
      modules/http2/h2_request.c, modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c, server/protocol.c.
    - debian/patches/CVE-2021-44224-2.patch: don't prevent forwarding URIs
      w/ no hostname in modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c.
    - CVE-2021-44224
  * SECURITY UPDATE: overflow in mod_lua multipart parser
    - debian/patches/CVE-2021-44790.patch: improve error handling in
      modules/lua/lua_request.c.
    - CVE-2021-44790

 -- Marc Deslauriers <email address hidden>  Wed, 05 Jan 2022 09:49:56 -0500

Available diffs

diff from 2.4.41-4ubuntu3.8 (in Ubuntu) to 2.4.41-4ubuntu3.9 (4.8 KiB)
diff from 2.4.41-4ubuntu3.6 to 2.4.41-4ubuntu3.9 (5.1 KiB)

2.4.46-4ubuntu1.5

Obsolete in hirsute-updates on 2022-07-23

Obsolete in hirsute-security on 2022-07-23

apache2 (2.4.46-4ubuntu1.5) hirsute-security; urgency=medium

  * SECURITY UPDATE: DoS or SSRF via forward proxy
    - debian/patches/CVE-2021-44224-1.patch: enforce that fully qualified
      uri-paths not to be forward-proxied have an http(s) scheme, and that
      the ones to be forward proxied have a hostname in
      include/http_protocol.h, modules/http/http_request.c,
      modules/http2/h2_request.c, modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c, server/protocol.c.
    - debian/patches/CVE-2021-44224-2.patch: don't prevent forwarding URIs
      w/ no hostname in modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c.
    - CVE-2021-44224
  * SECURITY UPDATE: overflow in mod_lua multipart parser
    - debian/patches/CVE-2021-44790.patch: improve error handling in
      modules/lua/lua_request.c.
    - CVE-2021-44790

 -- Marc Deslauriers <email address hidden>  Wed, 05 Jan 2022 09:38:48 -0500

Available diffs

diff from 2.4.46-4ubuntu1.4 (in Ubuntu) to 2.4.46-4ubuntu1.5 (4.9 KiB)
diff from 2.4.46-4ubuntu1.3 to 2.4.46-4ubuntu1.5 (5.8 KiB)

2.4.48-3.1ubuntu3.2

Superseded in impish-updates on 2022-03-17

Superseded in impish-security on 2022-03-17

apache2 (2.4.48-3.1ubuntu3.2) impish-security; urgency=medium

  * SECURITY UPDATE: DoS or SSRF via forward proxy
    - debian/patches/CVE-2021-44224-1.patch: enforce that fully qualified
      uri-paths not to be forward-proxied have an http(s) scheme, and that
      the ones to be forward proxied have a hostname in
      include/http_protocol.h, modules/http/http_request.c,
      modules/http2/h2_request.c, modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c, server/protocol.c.
    - debian/patches/CVE-2021-44224-2.patch: don't prevent forwarding URIs
      w/ no hostname in modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c.
    - CVE-2021-44224
  * SECURITY UPDATE: overflow in mod_lua multipart parser
    - debian/patches/CVE-2021-44790.patch: improve error handling in
      modules/lua/lua_request.c.
    - CVE-2021-44790

 -- Marc Deslauriers <email address hidden>  Wed, 05 Jan 2022 09:29:15 -0500

Available diffs

2.4.51-2ubuntu1

Superseded in jammy-release on 2022-02-05

Deleted in jammy-proposed on 2022-02-06 (Reason: Moved to jammy)

apache2 (2.4.51-2ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.
      (LP 261198)
    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
      (LP 609177)
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/s/include-binaries: replace Debian with Ubuntu on default
      page and add Ubuntu icon file.
      (LP 1288690)
    - d/p/support-openssl3-*.patch: Backport various patches from
      https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
      failure to load when using OpenSSL 3.
      (LP #1951476)
  * Dropped:
    - d/apache2ctl: Also use systemd for graceful if it is in use.
      (LP: 1832182)
      [This introduced a performance regression.]
    - d/apache2ctl: Also use /run/systemd to check for systemd usage.
      (LP 1918209)
      [Not needed]
    - debian/patches/CVE-2021-33193.patch: refactor request parsing in
      include/ap_mmn.h, include/http_core.h, include/http_protocol.h,
      include/http_vhost.h, modules/http2/h2_request.c, server/core.c,
      server/core_filters.c, server/protocol.c, server/vhost.c.
      [Fixed in 2.4.48-4]
    - debian/patches/CVE-2021-34798.patch: add NULL check in
      server/scoreboard.c.
      [Fixed in 2.4.49-1]
    - debian/patches/CVE-2021-36160.patch: fix PATH_INFO setting for
      generic worker in modules/proxy/mod_proxy_uwsgi.c.
      [Fixed in 2.4.49-1]
    - debian/patches/CVE-2021-39275.patch: fix ap_escape_quotes
      substitution logic in server/util.c.
      [Fixed in 2.4.49-1]
    - arbitrary origin server via crafted request uri-path
      + debian/patches/CVE-2021-40438-pre1.patch: faster unix socket path
        parsing in the "proxy:" URL in modules/proxy/mod_proxy.c,
        modules/proxy/proxy_util.c.
      + debian/patches/CVE-2021-40438.patch: add sanity checks on the
        configured UDS path in modules/proxy/proxy_util.c.
      [Fixed in 2.4.49-3]
    - SECURITY REGRESSION: Issues in UDS URIs.  (LP #1945311)
      + debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
        rules in modules/mappers/mod_rewrite.c.
      + debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
        hostname in modules/mappers/mod_rewrite.c,
        modules/proxy/proxy_util.c.
      [Fixed in 2.4.49-3]

 -- Bryce Harrington <email address hidden>  Thu, 16 Dec 2021 14:09:26 -0800

Available diffs

diff from 2.4.48-3.1ubuntu4 to 2.4.51-2ubuntu1 (570.8 KiB)

2.4.48-3.1ubuntu4

Superseded in jammy-release on 2021-12-18

Deleted in jammy-proposed on 2021-12-19 (Reason: Moved to jammy)

apache2 (2.4.48-3.1ubuntu4) jammy; urgency=medium

  * d/p/support-openssl3-*.patch: Backport various patches from
    https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
    failure to load when using OpenSSL 3.  (LP: #1951476)

 -- Sergio Durigan Junior <email address hidden>  Fri, 26 Nov 2021 16:07:56 -0500

Available diffs

diff from 2.4.48-3.1ubuntu3 to 2.4.48-3.1ubuntu4 (7.7 KiB)

2.4.48-3.1ubuntu3.1

Superseded in impish-updates on 2022-01-06

Deleted in impish-proposed on 2022-01-07 (Reason: moved to -updates)

apache2 (2.4.48-3.1ubuntu3.1) impish; urgency=medium

  * Revert fix from 2.4.46-1ubuntu2, due to performance regression.
    (LP 1832182)

 -- Bryce Harrington <email address hidden>  Sun, 14 Nov 2021 23:49:31 +0000

Available diffs

diff from 2.4.48-3.1ubuntu3 to 2.4.48-3.1ubuntu3.1 (1.3 KiB)

2.4.46-4ubuntu1.4

Superseded in hirsute-updates on 2022-01-06

Deleted in hirsute-proposed on 2022-01-07 (Reason: moved to -updates)

apache2 (2.4.46-4ubuntu1.4) hirsute; urgency=medium

  * Revert fix from 2.4.46-1ubuntu2, due to performance regression.
    (LP 1832182)

 -- Bryce Harrington <email address hidden>  Sun, 14 Nov 2021 23:50:00 +0000

Available diffs

2.4.29-1ubuntu4.20

Superseded in bionic-updates on 2022-01-06

Deleted in bionic-proposed on 2022-01-07 (Reason: moved to -updates)

apache2 (2.4.29-1ubuntu4.20) bionic; urgency=medium

  * Revert fix from 2.4.29-1ubuntu4.19, due to performance regression.
    (LP 1832182)

 -- Bryce Harrington <email address hidden>  Sun, 14 Nov 2021 23:52:18 +0000

Available diffs

diff from 2.4.29-1ubuntu4.19 to 2.4.29-1ubuntu4.20 (1.2 KiB)

2.4.41-4ubuntu3.8

Superseded in focal-updates on 2022-01-06

Deleted in focal-proposed on 2022-01-07 (Reason: moved to -updates)

apache2 (2.4.41-4ubuntu3.8) focal; urgency=medium

  * Revert fix from 2.4.41-4ubuntu3.7, due to performance regression.
    (LP 1832182)

 -- Bryce Harrington <email address hidden>  Thu, 14 Oct 2021 09:24:43 -0700

Available diffs

diff from 2.4.41-4ubuntu3.7 to 2.4.41-4ubuntu3.8 (1.2 KiB)

2.4.41-4ubuntu3.7

Superseded in focal-updates on 2021-10-26

Deleted in focal-proposed on 2021-10-28 (Reason: moved to -updates)

apache2 (2.4.41-4ubuntu3.7) focal; urgency=medium

  * d/apache2ctl: Also use systemd for graceful if it is in use.
    (LP: #1832182)
    - This extends an earlier fix for the start command to behave
      similarly for restart / graceful.  Fixes service failures on
      unattended upgrade.

 -- Bryce Harrington <email address hidden>  Tue, 28 Sep 2021 22:28:10 +0000

Available diffs

2.4.29-1ubuntu4.19

Superseded in bionic-updates on 2021-12-02

Deleted in bionic-proposed on 2021-12-03 (Reason: moved to -updates)

apache2 (2.4.29-1ubuntu4.19) bionic; urgency=medium

  * d/apache2ctl: Also use systemd for graceful if it is in use.
    (LP: #1832182)
    - This extends an earlier fix for the start command to behave
      similarly for restart / graceful.  Fixes service failures on
      unattended upgrade.

 -- Bryce Harrington <email address hidden>  Tue, 28 Sep 2021 22:27:27 +0000

Available diffs

2.4.48-3.1ubuntu3

Superseded in jammy-release on 2021-12-06

Obsolete in impish-release on 2022-07-23

Deleted in impish-proposed (Reason: Moved to impish)

apache2 (2.4.48-3.1ubuntu3) impish; urgency=medium

  * SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
    - debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
      rules in modules/mappers/mod_rewrite.c.
    - debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
      hostname in modules/mappers/mod_rewrite.c,
      modules/proxy/proxy_util.c.

 -- Marc Deslauriers <email address hidden>  Tue, 28 Sep 2021 08:52:26 -0400

Available diffs

diff from 2.4.48-3.1ubuntu2 to 2.4.48-3.1ubuntu3 (1.6 KiB)

2.4.29-1ubuntu4.18

Superseded in bionic-updates on 2021-10-07

Superseded in bionic-security on 2022-01-06

apache2 (2.4.29-1ubuntu4.18) bionic-security; urgency=medium

  * SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
    - debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
      rules in modules/mappers/mod_rewrite.c.
    - debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
      hostname in modules/mappers/mod_rewrite.c,
      modules/proxy/proxy_util.c.

 -- Marc Deslauriers <email address hidden>  Tue, 28 Sep 2021 07:01:16 -0400

Available diffs

diff from 2.4.29-1ubuntu4.17 to 2.4.29-1ubuntu4.18 (1.6 KiB)

2.4.46-4ubuntu1.3

Superseded in hirsute-updates on 2021-12-02

Superseded in hirsute-security on 2022-01-06

apache2 (2.4.46-4ubuntu1.3) hirsute-security; urgency=medium

  * SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
    - debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
      rules in modules/mappers/mod_rewrite.c.
    - debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
      hostname in modules/mappers/mod_rewrite.c,
      modules/proxy/proxy_util.c.

 -- Marc Deslauriers <email address hidden>  Tue, 28 Sep 2021 06:57:42 -0400

Available diffs

diff from 2.4.46-4ubuntu1.2 to 2.4.46-4ubuntu1.3 (1.6 KiB)

2.4.41-4ubuntu3.6

Superseded in focal-updates on 2021-10-07

Superseded in focal-security on 2022-01-06

apache2 (2.4.41-4ubuntu3.6) focal-security; urgency=medium

  * SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
    - debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
      rules in modules/mappers/mod_rewrite.c.
    - debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
      hostname in modules/mappers/mod_rewrite.c,
      modules/proxy/proxy_util.c.

 -- Marc Deslauriers <email address hidden>  Tue, 28 Sep 2021 07:00:45 -0400

Available diffs

diff from 2.4.41-4ubuntu3.5 to 2.4.41-4ubuntu3.6 (1.6 KiB)

2.4.41-4ubuntu3.5

Superseded in focal-updates on 2021-09-28

Superseded in focal-security on 2021-09-28

apache2 (2.4.41-4ubuntu3.5) focal-security; urgency=medium

  * SECURITY UPDATE: request splitting over HTTP/2
    - debian/patches/CVE-2021-33193-pre1.patch: process early errors via a
      dummy HTTP/1.1 request as well in modules/http2/h2.h,
      modules/http2/h2_request.c, modules/http2/h2_session.c,
      modules/http2/h2_stream.c.
    - debian/patches/CVE-2021-33193-pre2.patch: sync with github standalone
      version 1.15.17 in modules/http2/h2_bucket_beam.c,
      modules/http2/h2_config.c, modules/http2/h2_config.h,
      modules/http2/h2_h2.c, modules/http2/h2_headers.c,
      modules/http2/h2_headers.h, modules/http2/h2_mplx.c,
      modules/http2/h2_request.c, modules/http2/h2_stream.h,
      modules/http2/h2_task.c, modules/http2/h2_task.h,
      modules/http2/h2_version.h.
    - debian/patches/CVE-2021-33193.patch: refactor request parsing in
      include/ap_mmn.h, include/http_core.h, include/http_protocol.h,
      include/http_vhost.h, modules/http2/h2_request.c, server/core.c,
      server/core_filters.c, server/protocol.c, server/vhost.c.
    - CVE-2021-33193
  * SECURITY UPDATE: NULL deref via malformed requests
    - debian/patches/CVE-2021-34798.patch: add NULL check in
      server/scoreboard.c.
    - CVE-2021-34798
  * SECURITY UPDATE: DoS in mod_proxy_uwsgi
    - debian/patches/CVE-2021-36160.patch: fix PATH_INFO setting for
      generic worker in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2021-36160
  * SECURITY UPDATE: buffer overflow in ap_escape_quotes
    - debian/patches/CVE-2021-39275.patch: fix ap_escape_quotes
      substitution logic in server/util.c.
    - CVE-2021-39275
  * SECURITY UPDATE: arbitrary origin server via crafted request uri-path
    - debian/patches/CVE-2021-40438-pre1.patch: faster unix socket path
      parsing in the "proxy:" URL in modules/proxy/mod_proxy.c,
      modules/proxy/proxy_util.c.
    - debian/patches/CVE-2021-40438.patch: add sanity checks on the
      configured UDS path in modules/proxy/proxy_util.c.
    - CVE-2021-40438

 -- Marc Deslauriers <email address hidden>  Thu, 23 Sep 2021 12:58:57 -0400

Available diffs

diff from 2.4.41-4ubuntu3.4 (in Ubuntu) to 2.4.41-4ubuntu3.5 (20.7 KiB)
diff from 2.4.41-4ubuntu3.3 to 2.4.41-4ubuntu3.5 (21.3 KiB)

Ubuntuapache2 package

Change log for apache2 package in Ubuntu

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Ubuntu
apache2 package