[ubuntu/oracular-proposed] apache2 2.4.59-2ubuntu2 (Accepted)

Bryce Harrington bryce at canonical.com
Mon Jun 10 23:10:15 UTC 2024 

apache2 (2.4.59-2ubuntu2) oracular; urgency=medium

  * d/index.html, d/apache2.postrm: Fix https link to apache documentation.
    (LP: #2045055)

apache2 (2.4.59-2ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064378). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)
    - d/control: Upgrade lua build dependency to 5.4
      (LP #1910372)
    - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
      dolphin and Konqueror/5 careful redirection so that directories can be
      deleted via webdav.
      (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
  * Dropped:
    - d/p/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
      [Included in 2.4.59]
    - HTTP Response Splitting in multiple modules
      + d/p/CVE-2024-24795.patch: let httpd handle CL/TE for
        non-http handlers in include/util_script.h,
        modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
        modules/generators/mod_cgid.c, modules/http/http_filters.c,
        modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
        modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
      [Included in 2.4.59]
    - HTTP/2 DoS by memory exhaustion on endless continuation frames
      + d/p/CVE-2024-27316.patch: bail after too many failed reads
        in modules/http2/h2_session.c, modules/http2/h2_stream.c,
        modules/http2/h2_stream.h.
      [Included in 2.4.59]

apache2 (2.4.59-2) unstable; urgency=medium

  * Breaks against fossil due to CVE-2024-24795 follows up

apache2 (2.4.59-1) unstable; urgency=medium

  [ Stefan Fritsch ]
  * Remove old transitional packages libapache2-mod-md and
    libapache2-mod-proxy-uwsgi. Closes: #1032628

  [ Yadd ]
  * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
  * Refresh patches
  * New upstream version 2.4.59
    (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
  * Refresh patches
  * Update patches
  * Update test framework

Date: Mon, 10 Jun 2024 23:04:49 +0000
Changed-By: Bryce Harrington <bryce at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/+source/apache2/2.4.59-2ubuntu2
-------------- next part --------------
Format: 1.8
Date: Mon, 10 Jun 2024 23:04:49 +0000
Source: apache2
Built-For-Profiles: noudeb
Architecture: source
Version: 2.4.59-2ubuntu2
Distribution: oracular
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Bryce Harrington <bryce at canonical.com>
Closes: 1032628 1054564 1060450 1068412
Launchpad-Bugs-Fixed: 2045055 2064378
Changes:
 apache2 (2.4.59-2ubuntu2) oracular; urgency=medium
 .
   * d/index.html, d/apache2.postrm: Fix https link to apache documentation.
     (LP: #2045055)
 .
 apache2 (2.4.59-2ubuntu1) oracular; urgency=medium
 .
   * Merge with Debian unstable (LP: #2064378). Remaining changes:
     - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
       d/source/include-binaries, d/t/check-ubuntu-branding: Replace
       Debian with Ubuntu on default homepage.
       (LP #1966004, LP #1947459)
     - d/apache2.py, d/apache2-bin.install: Add apport hook
       (LP #609177)
     - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
       d/apache2.dirs: Add ufw profiles
       (LP #261198)
     - d/control: Upgrade lua build dependency to 5.4
       (LP #1910372)
     - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
       dolphin and Konqueror/5 careful redirection so that directories can be
       deleted via webdav.
       (LP #1927742)
     - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
       postinst script through a trigger (i.e., postinst triggered).
       Thanks to Roel van Meer. (Closes: #1060450)
       (LP #2038912)
   * Dropped:
     - d/p/CVE-2023-38709.patch: header validation after
       content-* are eval'ed in modules/http/http_filters.c.
       [Included in 2.4.59]
     - HTTP Response Splitting in multiple modules
       + d/p/CVE-2024-24795.patch: let httpd handle CL/TE for
         non-http handlers in include/util_script.h,
         modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
         modules/generators/mod_cgid.c, modules/http/http_filters.c,
         modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
         modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
       [Included in 2.4.59]
     - HTTP/2 DoS by memory exhaustion on endless continuation frames
       + d/p/CVE-2024-27316.patch: bail after too many failed reads
         in modules/http2/h2_session.c, modules/http2/h2_stream.c,
         modules/http2/h2_stream.h.
       [Included in 2.4.59]
 .
 apache2 (2.4.59-2) unstable; urgency=medium
 .
   * Breaks against fossil due to CVE-2024-24795 follows up
 .
 apache2 (2.4.59-1) unstable; urgency=medium
 .
   [ Stefan Fritsch ]
   * Remove old transitional packages libapache2-mod-md and
     libapache2-mod-proxy-uwsgi. Closes: #1032628
 .
   [ Yadd ]
   * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
   * Refresh patches
   * New upstream version 2.4.59
     (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
   * Refresh patches
   * Update patches
   * Update test framework
Checksums-Sha1:
 9583c2930aa13c0872e952eb7d0b2880d1016729 3194 apache2_2.4.59-2ubuntu2.dsc
 d1f5101fb302298254d78cdfebc9d449f0413865 840636 apache2_2.4.59-2ubuntu2.debian.tar.xz
 0b8b0320c00e32ef0e200929a39bb818cfc03c15 8955 apache2_2.4.59-2ubuntu2_source.buildinfo
Checksums-Sha256:
 f035291a951c03eb1395413596706dd5baea8396888bac17df196cb6ee533266 3194 apache2_2.4.59-2ubuntu2.dsc
 eef4861005ae9dd1660d0645a9ececbc9518aaab96c53912fb38c3e3680835eb 840636 apache2_2.4.59-2ubuntu2.debian.tar.xz
 f84e7a8f9328d531cf20092717a6e46cd064bd9974c3b6ac15ea69206c157514 8955 apache2_2.4.59-2ubuntu2_source.buildinfo
Files:
 8365b27bf37c048fe91e00c8bf71f310 3194 httpd optional apache2_2.4.59-2ubuntu2.dsc
 df65af7b948630ebd1f8303dcff24494 840636 httpd optional apache2_2.4.59-2ubuntu2.debian.tar.xz
 552373b2d79a9245ea06831afe5a3f31 8955 httpd optional apache2_2.4.59-2ubuntu2_source.buildinfo
Original-Maintainer: Debian Apache Maintainers <debian-apache at lists.debian.org>
Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/apache2
Vcs-Git-Commit: bdc24ce1173a8957fede79fa801580dd067c69a2
Vcs-Git-Ref: refs/heads/merge-v2.4.59-2-oracular

More information about the oracular-changes mailing list