ubuntu/+source/apache2:applied/ubuntu/xenial-security

Last commit made on 2019-04-04
Get this branch:
git clone -b applied/ubuntu/xenial-security https://git.launchpad.net/ubuntu/+source/apache2
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
applied/ubuntu/xenial-security
Repository:
lp:ubuntu/+source/apache2

Recent commits

46ba68e... by Marc Deslauriers on 2019-04-03

Import patches-applied version 2.4.18-2ubuntu3.10 to applied/ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 041036cbb488e4081930732e86d7bef90544f695
Unapplied parent: 968d270b6c23720cf71160d4025998be6891eaf9

New changelog entries:
  * SECURITY UPDATE: mod_session expiry time issue
    - debian/patches/CVE-2018-17199.patch: always decode session attributes
      early in modules/session/mod_session.c.
    - CVE-2018-17199
  * SECURITY UPDATE: privilege escalation from modules' scripts
    - debian/patches/CVE-2019-0211.patch: bind the bucket number of each
      child to its slot number in include/scoreboard.h,
      server/mpm/event/event.c, server/mpm/prefork/prefork.c,
      server/mpm/worker/worker.c.
    - CVE-2019-0211
  * SECURITY UPDATE: mod_auth_digest access control bypass
    - debian/patches/CVE-2019-0217.patch: fix a race condition in
      modules/aaa/mod_auth_digest.c.
    - CVE-2019-0217
  * SECURITY UPDATE: URL normalization inconsistincy
    - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
      the path in include/http_core.h, include/httpd.h, server/core.c,
      server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
      in server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
      server/util.c.
    - CVE-2019-0220

968d270... by Marc Deslauriers on 2019-04-03

[PATCH] *) maintainer mode fix for util.c no2slash_ex trunk

Gbp-Pq: CVE-2019-0220-3.patch.

47db4a4... by Marc Deslauriers on 2019-04-03

[PATCH] merge 1855743,1855744 ^/httpd/httpd/trunk .

Gbp-Pq: CVE-2019-0220-2.patch.

77557fa... by Marc Deslauriers on 2019-04-03

[PATCH] Merge of r1855705 from trunk:

Gbp-Pq: CVE-2019-0220-1.patch.

c7fcb4d... by Marc Deslauriers on 2019-04-03

[PATCH] Merge r1853190 from trunk:

Gbp-Pq: CVE-2019-0217.patch.

f1bc48b... by Marc Deslauriers on 2019-04-03

[PATCH] Merge r1855306 from trunk:

Gbp-Pq: CVE-2019-0211.patch.

2790d67... by Marc Deslauriers on 2019-04-03

[PATCH] mod_session: Always decode session attributes early.

Gbp-Pq: CVE-2018-17199.patch.

6c8fb0a... by Marc Deslauriers on 2019-04-03

silently ignore a not existent file path with IncludeOptional

Gbp-Pq: includeoptional-ignore-non-existent.patch.

89778b5... by Marc Deslauriers on 2019-04-03

fix insecure nonce generation

Gbp-Pq: CVE-2018-1312.patch.

25db533... by Marc Deslauriers on 2019-04-03

fix mod_cache_socache DoS

Gbp-Pq: CVE-2018-1303.patch.