Number of commits found: 42

www/apache24: Fix httpoxy vulnerability (+2.2)

  - Add upstream patch to www/apache24
  - Add upstream patch to www/apache22
  - Bump PORTREVISION

Approved by:    feld (ports-secteam)
MFH:            2016Q3
Security:       cf0b5668-4d1b-11e6-b2ec-b499baebfeaf
Security:       CVE-2016-5387

o update to 2.4.23
o disable build time stamp in favor of reproducible build
o remove obsolate scoreboard/status patch
o s/USE_OPENSSL=yes/USES=ssl/
o add OPTION for two new modules:
   mod_proxy_hcheck (default=on)
   mod_http2_proxy (experimental => default=off)

Changelog:
 http://www.apache.org/dist/httpd/CHANGES_2.4.23

MFH:		2016Q3

- fix scoreboard, backport fix from [1]
- bump PORTREVISION

For details see discussion:
 http://mail-archives.apache.org/mod_mbox/httpd-dev/201604.mbox/browser

Thanks to Ken J. for reporting the issue and testing the patch!

Reported by:	Ken J. (on apache@ list)
Obtained from:	http://home.apache.org/~ylavic/patches/scoreboard-2.4.18.diff 
[1]
MFH:		2016Q2

- update to 2.4.20
- use ${OPTION}_IMPLIES and remove some IGNORES
- turn on proxy_html and xml2enc as default [1]

[1] Often requested by users. The modules are not enabled in
    the default configuration.

Full changelog for apache version 2.4.19/2.4.20:
 http://www.apache.org/dist/httpd/CHANGES_2.4.20

Note: Apache httpd 2.4.19 was not released.

MFH:	2016Q2

Remove ${PORTSDIR}/ from dependencies, categories v, w, x, y, and z.

With hat:	portmgr
Sponsored by:	Absolight

- use new $opt-target
- improve kldstat check
- use new defined postexec, preunexec in pkg-plist

with hat apache@

- update to 2.4.18
- backport r1719967
  mod_ssl: fix build with openssl < 0.9.8m (missing semicolon).

This release also contains the patch for FreeBSD PR 204304
 Make the fix for fully qualifying REDIRECT_URL from PR#57785 opt-in.
 http://svn.apache.org/viewvc?view=revision&revision=1712268

Changes with Apache 2.4.18

  *) mod_ssl: for all ssl_engine_vars.c lookups, fall back to master connection
     if conn_rec itself holds no valid SSLConnRec*. Fixes PR58666.
     [Stefan Eissing]

  *) mod_http2: connection level window for flow control is set to protocol

(Only the first 15 lines of the commit message are shown above )

- fix build with nghttp2

no version bump as OPTION is off by default

PR:		204293
Submitted by:	<idefix_at_fechner.net>

- update to 2.4.17
- add support for HTTP/2 (RFC 7540)
- remove obsolate libressl patches [1]

In this release are some exciting new features including:

 *) HTTP/2 support via mod_http2 module
 *) Support for SO_REUSEPORT in MPMs for significant scalability

Changes with Apache 2.4.17

 *) mod_http2: added donated HTTP/2 implementation via core module. Similar
    configuration options to mod_ssl. [Stefan Eissing]

 *) mod_proxy: don't recyle backend announced "Connection: close" connections

(Only the first 15 lines of the commit message are shown above )

By default libtool replaces -export-symbols <file> with -retain-symbols-file
<file> on ELF systems, but this doesn't really do what -export-symbols is
meant to do.  On GNU ELF systems it converts <file> to a simple version
script first and then uses -version-script instead of -retain-symbols-file.
Let USES=libtool patch libtool scripts to do this on all systems with GNU
ld(1).

Bump PORTREVISION on all ports where the build log contains -export-symbols.

audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions.  Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to.  Fix a number of other issues in the same

(Only the first 15 lines of the commit message are shown above )

www/apache24: fix CVEs, update 2.4.12 -> 2.4.16

- Convet to USES=autoreconf
- Sort USES
- Remove now empty patch files

Security:              
https://vuxml.freebsd.org/freebsd/a12494c1-2af4-11e5-86ff-14dae9d210b8.html
Differential Revision:  https://reviews.freebsd.org/D3101

Submitted by:           feld
Reviewed by:            pgollucci (myself)
With Hat:               apache@
MFH:                    2015Q3

MASTER_SITES cleanup.

- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
  of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
  no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.

While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.

Also, replace some EXTRACT_SUFX occurences with USES=tar:*.

Checked by:	make fetch-urlall-list
With hat:	portmgr
Sponsored by:	Absolight

- Remove libtool hacks and patches that are now handled by USES=libtool
- Remove CONFIG_SHELL from CONFIGURE_ENV because bsd.port.mk handles that

- update to 2.4.12

- change MPM backend from static to dynamic,
  but keep mpm_prefork for compatiblity with e.g. php modules
- install dedicated MPM load file in case httpd was build with modular MPM
  (modules.d/000_mpm_prefork_fallback.conf)
- disable SSLv3 and SSLv2 fallback in sample httpd-ssl-conf
- use @sample macro instead EXAMPLESDIR
- add some SSLCipherSuite examples for OpenSSL >= 1.0.x
- add libressl support [1]
- add pkg-install script (to handle new modular MPM build)
- build now most all modules, so users using packages don't have
  to run a custom build for missing modules
- fix suexec mode

PR:		196139 [1]
MFH:		2015Q1

- make QA script happy and RMDIR empty folder below $PORTDOCS
  the script complans on them even PORTDOCS=* is set
- do not slence INSTALL commands

apache24

- remove check if apr is build with threads
- bump PORTREVISION
- adopt new pkg-plist @dir

@with hat apache@

Remove unused LIBTOOLFILES

- adjust default modules, changed during the last revisions
  + SESSION_DBD
  + SLOTMEM_SHM (e.g neeed for mod_ajp)
  - CERN_META

- Use OPTION desc. from modules/config.m4 to match upstream
- bump PORTREVISION

with hat apache@

MFH:		2014Q3

- security update to release 2.4.10

- add OPTION for new mod_authnz_fcgi module

- s/libluajit.so/libluajit-5.1.so/ (there is no libluajit.so)

- backport for mod_lua: Don't quote values in cookies
   Make IE happy again [#56734]
   http://svn.apache.org/viewvc?view=revision&revision=1611744

- disable sanity check on demand [1]

Release Notes:
 http://www.apache.org/dist/httpd/CHANGES_2.4.10

PR:		191398 [1]
Submitted by:	Robert Schulze <rs@bytecamp.net>
MFH:		2014Q3
Security:	4364e1f1-0f44-11e4-b090-20cf30e32f6d
		CVE-2014-0117
		CVE-2014-3523
		CVE-2014-0226
		CVE-2014-0118
		CVE-2014-0231

Use modern LIB_DEPENDS on non default options

Submitted by:	ohauer

- revert conflict (apache22 has MPM sub ports)

- strip
- remove obsolete apache-*-2.2.* conflict
- add modules.d to EXAMPLESDIR
- always install DOC (remove Makefile hack)
- bump PORREVISION
- sort pkg-plist

- fix build with lua51 / lua52
- strip trailing white space
- no PORTREVISION bump (LUA is not a default OPTION)

Lua build issue reported on apache@ and lua@
 by Peter Olsson and Jason Hellenthal

- fix LIB_DEPENDS (after adding libtool:keepla to devel/apr1)
- bump PORTREVISION

Submitted by:	David Cecchin <dcecchin@gmail.com>

Add CPE information.

With hat:	ports-secteam

- /USE_AUTOTOOLS=libtool/USES=libtool/

with hat apache@

Replace lang/lua with the new lang/lua51

lang/lua51 is working the same way lang/lua52, chase ports using lua 5.1
Make the default lua lua52
Make all lua ports using USES=lua

Approved by:	portmgr (implicit)

The FreeBSD x11@ and graphics team proudly presents
a zeising, kwm production, with help from dumbbell, bdrewery:

NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE

This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.

This patch also contains updates of libxcb and related ports, pixman, as well

(Only the first 15 lines of the commit message are shown above )

- mod_authn_socache.c: fix creation of default socache_instance.
- add Note how the OpenSSL version used to build httpd is found (apr-1-config)

Upstream r1576233 commit message
================================
In pre_config, default socache_provider is created, but socache_instance
initialization is missing. This leads to crash on startup if default
socache_provider is used (AuthnCacheSOCache is not called) and
AuthnCacheEnable or AuthnCacheProvideFor is used.

Submitted by:	Michael Bennett (per PM)
Obtained from:	http://svn.apache.org/viewvc?view=revision&revision=1576233

- update to 2.4.9
- enforcing use libapr-1.so.5 (apr-1.5.0 instead apr-1.4.8)

Changes with Apache 2.4.9

  *) mod_ssl: Work around a bug in some older versions of OpenSSL that
     would cause a crash in SSL_get_certificate for servers where the
     certificate hadn't been sent. [Stephen Henson]

   *) mod_lua: Add a fixups hook that checks if the original request is intended
      for LuaMapHandler. This fixes a bug where FallbackResource invalidates the
      LuaMapHandler directive in certain cases by changing the URI before the
map
      handler code executes [Daniel Gruno, Daniel Ferradal <dferradal gmail
com>].

Changes with Apache 2.4.8

(Only the first 15 lines of the commit message are shown above )

- add patch for apache bug-id 55306
- bump PORTREVISION

There is an subversion update on the way and we will see the new
subversion before apache24-2.4.7 so adopt the mod_dav patches
from upstrem.

  - add new directory for modules (APACHEETCDIR/modules.d)

    New modules can be registered here with a simple
    file that contains the LoadModule directives.
    Additonal Maintaines can write instructions to the
    conf file and keep pkg-message short.
    As bonus the config file can be installed like every
    other config file with a .sample extention so modules
    are not disabled during pkg upgrades.

    Module config files should begin with three digits
    followed by '_' e.g. 100_php5.conf.
    The load order can be controlled via the three digits.

    Please wait some time before adopting the new directory
    so users have time to update and adjust axisting configs

- no revision bump, devel/apr was updated and we will see
  apache 2.2.7 in the next days (I only want to have the
  modules.d directory adopted)

  - support staging
  - partitial adopt new ${opt}_ notation

Add NO_STAGE all over the place in preparation for the staging support (cat:
www)

- convert to the new perl5 framework
- convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)

Introduce variable ICONV_PREFIX at Mk/Uses/iconv.mk. The default for
pre 100043 is ${LOCALBASE} and /usr otherwise. Convert all ports to
new variable usage.

Approved by:	portmgr (bapt, implicit)

- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)

- update to apache24-2.4.6
 - new modules: mod_cache_socache, mod_macro and mod_proxy_wstunnel

- add enty to vuxml

SECURITY: CVE-2013-1896 (cve.mitre.org)
 mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with
 the source href (sent as part of the request body as XML) pointing to a
 URI that is not configured for DAV will trigger a segfault.

SECURITY: CVE-2013-2249 (cve.mitre.org)
 mod_session_dbd: Make sure that dirty flag is respected when saving
 sessions, and ensure the session ID is changed each time the session
 changes. This changes the format of the updatesession SQL statement.
 Existing configurations must be changed.

Changelog:
http://www.apache.org/dist/httpd/CHANGES_2.4.6

with hat apache@

Security:	ca4d63fb-f15c-11e2-b183-20cf30e32f6d

- enable NSS crypto driver
- use service(8) in apachectl where it makes sence
- bump PORTREVISION

- Convert USE_ICONV=yes to USES=iconv
- Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig and
  USE_GETTEXT=yes to USES=gettext while here

- fix build on sparc64 machine

Feature safe: yes

with hat apache@

PR:		177693
Submitted by:	Michael Moll <kvedulv@kvedulv.de>
Obtained from:	http://svn.apache.org/viewvc?view=revision&revision=1470183

- new port www/apache24

The Apache HTTP Server Project is an effort to develop and maintain an
open-source HTTP server for various modern desktop and server operating
systems, such as UNIX and Windows NT. The goal of this project is to
provide a secure, efficient and extensible server which provides HTTP
services in sync with the current HTTP standards.
The 2.x branch of Apache Web Server includes several improvements like
threading, use of APR, native IPv6 and SSL support, and many more.

WWW: http://httpd.apache.org/

Note:
 Since apache24 does not enable every module by default in httpd.conf the
 list of modules to build was preselected to match build param

(Only the first 15 lines of the commit message are shown above )

Number of commits found: 42

13 vulnerabilities affecting 38 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities