apache2 2.4.41-4ubuntu3.19 source package in Ubuntu
Changelog
apache2 (2.4.41-4ubuntu3.19) focal-security; urgency=medium * SECURITY UPDATE: null pointer dereference when serving WebSocket protocol upgrades over a HTTP/2 - debian/patches/CVE-2024-36387.patch: early exit if bb is null in modules/http2/h2_c2.c. - CVE-2024-36387 * SECURITY UPDATE: encoding problem in mod_proxy - debian/patches/CVE-2024-38473-1.patch: escape for non-proxypass configuration in modules/proxy/mod_proxy.c. - debian/patches/CVE-2024-38473-2.patch: fixup UDS filename for mod_proxy called through r->handler in modules/proxy/mod_proxy.c, modules/proxy/mod_proxy.h, modules/proxy/proxy_util.c. - debian/patches/CVE-2024-38473-3.patch: block inadvertent subst of special filenames in modules/mappers/mod_rewrite.c. - debian/patches/CVE-2024-38473-4.patch: fix comparison of local path on Windows in modules/mappers/mod_rewrite.c. - debian/patches/CVE-2024-38473-5.patch: factor out IS_SLASH, perdir fix in include/httpd.h, modules/mappers/mod_rewrite.c, server/util.c. - CVE-2024-38473 * SECURITY UPDATE: Substitution encoding issue in mod_rewrite - debian/patches/CVE-2024-38474_5.patch: tighten up prefix_stat and %3f handling in modules/mappers/mod_rewrite.c. - CVE-2024-38474 * SECURITY UPDATE: Improper escaping of output in mod_rewrite - Included in CVE-2024-38474_5.patch. - CVE-2024-38475 * SECURITY UPDATE: information disclosure, SSRF or local script execution - debian/patches/CVE-2024-38476-pre1.patch: add concept of binary notes to request_rec in include/httpd.h. - debian/patches/CVE-2024-38476.patch: add ap_set_content_type_ex to differentiate trusted sources in include/http_protocol.h, include/httpd.h, modules/http/http_protocol.c, modules/http/mod_mime.c, modules/mappers/mod_actions.c, modules/mappers/mod_negotiation.c, modules/mappers/mod_rewrite.c, modules/metadata/mod_headers.c, modules/metadata/mod_mime_magic.c, server/config.c, server/core.c. - CVE-2024-38476 * SECURITY UPDATE: null pointer dereference in mod_proxy - debian/patches/CVE-2024-38477.patch: validate hostname in modules/proxy/proxy_util.c. - CVE-2024-38477 * SECURITY UPDATE: Potential SSRF in mod_rewrite - Fixed by patches in previous CVEs. - CVE-2024-39573 * SECURITY UPDATE: source code disclosure with handlers configured via AddType - debian/patches/CVE-2024-39884.patch: maintain trusted flag in modules/cluster/mod_heartmonitor.c, modules/dav/main/mod_dav.c, modules/examples/mod_example_hooks.c, modules/filters/mod_data.c, modules/filters/mod_include.c, modules/filters/mod_proxy_html.c, modules/generators/mod_cgi.c, modules/generators/mod_cgid.c, modules/generators/mod_info.c, modules/generators/mod_status.c, modules/http/http_filters.c, modules/http/http_protocol.c, modules/http/http_request.c, modules/ldap/util_ldap.c, modules/mappers/mod_imagemap.c, modules/proxy/mod_proxy_balancer.c. - CVE-2024-39884 -- Marc Deslauriers <email address hidden> Thu, 04 Jul 2024 08:31:12 -0400
Upload details
- Uploaded by:
- Marc Deslauriers
- Uploaded to:
- Focal
- Original maintainer:
- Ubuntu Developers
- Architectures:
- any all
- Section:
- httpd
- Urgency:
- Medium Urgency
See full publishing history Publishing
Series | Published | Component | Section |
---|
Downloads
File | Size | SHA-256 Checksum |
---|---|---|
apache2_2.4.41.orig.tar.gz | 8.8 MiB | 3c0f9663240beb0f008acf3b4501c4f339d7467ee345a36c86c46b4d6f3a5461 |
apache2_2.4.41-4ubuntu3.19.debian.tar.xz | 1.3 MiB | 89af5947e93e766656587d6e82d69549196b2fd0b5cfd0f5cba823a23e2bb861 |
apache2_2.4.41-4ubuntu3.19.dsc | 3.3 KiB | 8af11a56cf1d9b2e286b15c3c7cd6b212f2beb760a863e4264157ea1104e90c4 |
Available diffs
Binary packages built by this source
- apache2: Apache HTTP Server
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
Installing this package results in a full installation, including the
configuration files, init scripts and support scripts.
- apache2-bin: Apache HTTP Server (modules and other binary files)
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
This package contains the binaries only and does not set up a working
web-server instance. Install the "apache2" package to get a fully working
instance.
- apache2-bin-dbgsym: debug symbols for apache2-bin
- apache2-data: Apache HTTP Server (common files)
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
This package contains architecture-independent common files such as icons,
error pages and static index files.
- apache2-dev: Apache HTTP Server (development headers)
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
This package provides development headers and the apxs2 binary for the Apache
2 HTTP server, useful to develop and link third party additions to the Debian
Apache HTTP server package.
.
It also provides dh_apache2 and dh sequence addons useful to install various
Debian Apache2 extensions with debhelper. It supports
- Apache 2 module configurations and shared objects
- Site configuration files
- Global configuration files
- apache2-doc: Apache HTTP Server (on-site documentation)
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
This package provides the documentation for the Apache 2 HTTP server. The
documentation is shipped in HTML format and can be accessed from a local
running Apache HTTP server instance or by browsing the file system directly.
- apache2-ssl-dev: Apache HTTP Server (mod_ssl development headers)
The Apache HTTP Server Project's goal is to build a secure, efficient and
extensible HTTP server as standards-compliant open source software. The
result has long been the number one web server on the Internet.
.
This package provides the development header and the dependencies for
modules that interact with mod_ssl's internal openssl state.
- apache2-suexec-custom: Apache HTTP Server configurable suexec program for mod_suexec
Provides a customizable version of the suexec helper program for mod_suexec.
This is not the version from upstream, but can be configured with a
configuration file.
.
If you do not need non-standard document root or userdir settings, it is
recommended that you use the standard suexec helper program from the
apache2-suexec- pristine package instead.
- apache2-suexec-custom-dbgsym: debug symbols for apache2-suexec-custom
- apache2-suexec-pristine: Apache HTTP Server standard suexec program for mod_suexec
Provides the standard suexec helper program for mod_suexec. This version is
compiled with document root /var/www and userdir suffix public_html. If you
need different settings, use the package apache2-suexec- custom.
- apache2-suexec-pristine-dbgsym: debug symbols for apache2-suexec-pristine
- apache2-utils: Apache HTTP Server (utility programs for web servers)
Provides some add-on programs useful for any web server. These include:
- ab (Apache benchmark tool)
- fcgistarter (Start a FastCGI program)
- logresolve (Resolve IP addresses to hostnames in logfiles)
- htpasswd (Manipulate basic authentication files)
- htdigest (Manipulate digest authentication files)
- htdbm (Manipulate basic authentication files in DBM format, using APR)
- htcacheclean (Clean up the disk cache)
- rotatelogs (Periodically stop writing to a logfile and open a new one)
- split-logfile (Split a single log including multiple vhosts)
- checkgid (Checks whether the caller can setgid to the specified group)
- check_forensic (Extract mod_log_forensic output from Apache log files)
- httxt2dbm (Generate dbm files for use with RewriteMap)
- apache2-utils-dbgsym: debug symbols for apache2-utils
- libapache2-mod-md: transitional package
This is a transitional package to apache2 for users of libapache2-mod-md.
It can be safely removed after the installation is complete.
- libapache2-mod-proxy-uwsgi: transitional package
This is a transitional package to apache2 for users of
libapache2-mod-proxy- uwsgi.
It can be safely removed after the installation is complete.