CVS log for pkgsrc/www/apache2/options.mk

Up to [NetBSD + pkgsrc-wip] / pkgsrc / www / apache2

Request diff between arbitrary revisions - Display revisions graphically

Keyword substitution: kv
Default branch: MAIN

Changes 2.0.64:
* SECURITY: CVE-2010-1452 (cve.mitre.org)
  mod_dav: Fix Handling of requests without a path segment.
* SECURITY: CVE-2009-1891 (cve.mitre.org)
  Fix a potential Denial-of-Service attack against mod_deflate or other
  modules, by forcing the server to consume CPU time in compressing a
  large file after a client disconnects.
* SECURITY: CVE-2009-3095 (cve.mitre.org)
  mod_proxy_ftp: sanity check authn credentials.
* SECURITY: CVE-2009-3094 (cve.mitre.org)
  mod_proxy_ftp: NULL pointer dereference on error paths.
* SECURITY: CVE-2009-3555 (cve.mitre.org)
  mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection
  attack when compiled against OpenSSL version 0.9.8m or later. Introduces
  the 'SSLInsecureRenegotiation' directive to reopen this vulnerability
  and offer unsafe legacy renegotiation with clients which do not yet
  support the new secure renegotiation protocol, RFC 5746.
* SECURITY: CVE-2009-3555 (cve.mitre.org)
  mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
  for OpenSSL versions prior to 0.9.8l; reject any client-initiated
  renegotiations. Forcibly disable keepalive for the connection if there
  is any buffered data readable. Any configuration which requires
  renegotiation for per-directory/location access control is still
  vulnerable, unless using openssl 0.9.8l or later.
* SECURITY: CVE-2010-0434 (cve.mitre.org)
  Ensure each subrequest has a shallow copy of headers_in so that the
  parent request headers are not corrupted.  Elimiates a problematic
  optimization in the case of no request body.
* SECURITY: CVE-2008-2364 (cve.mitre.org)
  mod_proxy_http: Better handling of excessive interim responses
  from origin server to prevent potential denial of service and high
  memory usage.
* SECURITY: CVE-2010-0425 (cve.mitre.org)
  mod_isapi: Do not unload an isapi .dll module until the request
  processing is completed, avoiding orphaned callback pointers.
* SECURITY: CVE-2008-2939 (cve.mitre.org)
  mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
  the FTP URL. Discovered by Marc Bevand of Rapid7.
* Fix recursive ErrorDocument handling.
* mod_ssl: Do not do overlapping memcpy.
* Add Set-Cookie and Set-Cookie2 to the list of headers allowed to pass
  through on a 304 response.
* apxs: Fix -A and -a options to ignore whitespace in httpd.conf

Convert to use PLIST_VARS instead of manually passing "@comment "
through PLIST_SUBST to the plist module.

Make it easier to build and install packages "unprivileged", where
the owner of all installed files is a non-root user.  This change
affects most packages that require special users or groups by making
them use the specified unprivileged user and group instead.

(1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to
    unprivileged.mk.  These two variables are lists of other bmake
    variables that define package-specific users and groups.  Packages
    that have user-settable variables for users and groups, e.g. apache
    and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP},
    etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS
    so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER}
    and ${UNPRIVILEGED_GROUP}.

(2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.

Whitespace cleanup, courtesy of pkglint.
Patch provided by Sergey Svishchev in private mail.

The directories for configuration files and log files are now set in the
config.layout file instead of CONFIGURE_ARGS, to avoid defining things
twice. No actual change, since the paths are still the same.

Added all necessary variables to BUILD_DEFS, as reported by pkglint.

Update "apr" package to version 0.9.12.2.0.59 and "apache2" package
to version 2.0.59. Changes since *2.0.58:
- SECURITY: CVE-2006-3747 (cve.mitre.org)
  mod_rewrite: Fix an off-by-one security problem in the ldap scheme
  handling. For some RewriteRules this could lead to a pointer being
  written out of bounds.  Reported by Mark Dowd of McAfee.

- Add an option ${APACHE_SUEXEC_LOGFILE} so the user can specify
  where they would like the suexec logfile to go.  Ok'ed tron@
- Bump pkgrevision

Remove support for some variables that are supposed to go away after
pkgsrc-2004Q4 is branched.

Convert to use bsd.options.mk: APACHE_SUEXEC is now the "suexec" option.