apache2 2.4.34-1ubuntu2.1 source package in Ubuntu

Changelog

apache2 (2.4.34-1ubuntu2.1) cosmic-security; urgency=medium

  * SECURITY UPDATE: slowloris DoS in mod_http2
    - debian/patches/CVE-2018-17189.patch: change cleanup strategy for
      slave connections in modules/http2/h2_conn.c.
    - CVE-2018-17189
  * SECURITY UPDATE: mod_session expiry time issue
    - debian/patches/CVE-2018-17199.patch: always decode session attributes
      early in modules/session/mod_session.c.
    - CVE-2018-17199
  * SECURITY UPDATE: read-after-free on a string compare in mod_http2
    - debian/patches/CVE-2019-0196.patch: disentangelment of stream and
      request method in modules/http2/h2_request.c.
    - CVE-2019-0196
  * SECURITY UPDATE: privilege escalation from modules' scripts
    - debian/patches/CVE-2019-0211.patch: bind the bucket number of each
      child to its slot number in include/scoreboard.h,
      server/mpm/event/event.c, server/mpm/prefork/prefork.c,
      server/mpm/worker/worker.c.
    - CVE-2019-0211
  * SECURITY UPDATE: mod_auth_digest access control bypass
    - debian/patches/CVE-2019-0217.patch: fix a race condition in
      modules/aaa/mod_auth_digest.c.
    - CVE-2019-0217
  * SECURITY UPDATE: URL normalization inconsistincy
    - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
      the path in include/http_core.h, include/httpd.h, server/core.c,
      server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
      in server/request.c, server/util.c.
    - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
      server/util.c.
    - CVE-2019-0220

 -- Marc Deslauriers <email address hidden>  Wed, 03 Apr 2019 08:50:09 -0400

Upload details

Uploaded by:
Marc Deslauriers on 2019-04-03
Uploaded to:
Cosmic
Original maintainer:
Ubuntu Developers
Architectures:
any all
Section:
httpd
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
apache2_2.4.34.orig.tar.bz2 6.6 MiB fa53c95631febb08a9de41fd2864cfff815cf62d9306723ab0d4b8d7aa1638f0
apache2_2.4.34-1ubuntu2.1.debian.tar.xz 796.7 KiB 5c9aaf3ede67373a4b3faba562bbf7c20a27880632c705885e9fd1acd2d27d0e
apache2_2.4.34-1ubuntu2.1.dsc 3.2 KiB ff3d296571982c3f1f43187201a8798b5c78481b396f518c13011a7ca1c10560

View changes file

Binary packages built by this source

apache2: No summary available for apache2 in ubuntu cosmic.

No description available for apache2 in ubuntu cosmic.

apache2-bin: No summary available for apache2-bin in ubuntu cosmic.

No description available for apache2-bin in ubuntu cosmic.

apache2-data: No summary available for apache2-data in ubuntu cosmic.

No description available for apache2-data in ubuntu cosmic.

apache2-dbg: No summary available for apache2-dbg in ubuntu cosmic.

No description available for apache2-dbg in ubuntu cosmic.

apache2-dev: No summary available for apache2-dev in ubuntu cosmic.

No description available for apache2-dev in ubuntu cosmic.

apache2-doc: No summary available for apache2-doc in ubuntu cosmic.

No description available for apache2-doc in ubuntu cosmic.

apache2-ssl-dev: No summary available for apache2-ssl-dev in ubuntu cosmic.

No description available for apache2-ssl-dev in ubuntu cosmic.

apache2-suexec-custom: No summary available for apache2-suexec-custom in ubuntu cosmic.

No description available for apache2-suexec-custom in ubuntu cosmic.

apache2-suexec-pristine: No summary available for apache2-suexec-pristine in ubuntu cosmic.

No description available for apache2-suexec-pristine in ubuntu cosmic.

apache2-utils: No summary available for apache2-utils in ubuntu cosmic.

No description available for apache2-utils in ubuntu cosmic.

libapache2-mod-proxy-uwsgi: No summary available for libapache2-mod-proxy-uwsgi in ubuntu cosmic.

No description available for libapache2-mod-proxy-uwsgi in ubuntu cosmic.