[Buildroot] [PATCH 1/1] package/apache: security bump version to 2.4.46

Yann E. MORIN yann.morin.1998 at free.fr
Fri Aug 7 19:26:57 UTC 2020


Bernd, All,

On 2020-08-07 19:11 +0200, Bernd Kuhls spake thusly:
> Changelog: http://archive.apache.org/dist/httpd/CHANGES_2.4.46
> 
> Release notes: https://downloads.apache.org/httpd/Announcement2.4.html
> 
> Fixes CVE-2020-9490, CVE-2020-11984 & CVE-2020-11993:
> https://httpd.apache.org/security/vulnerabilities_24.html
> 
> Added all hashes provided by upstream.

md5 and sha1 are broken nowadays, so adding them is not interesting at
all, when there are better hashes available, which is the case here.

So I've dropped md5 and sha1, and used a single comment to refer to both
upstream locations.

Applied to master, thanks.

> Signed-off-by: Bernd Kuhls <bernd.kuhls at t-online.de>
> ---
>  package/apache/apache.hash | 10 ++++++++--
>  package/apache/apache.mk   |  2 +-
>  2 files changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/package/apache/apache.hash b/package/apache/apache.hash
> index 7b0e4ad8e7..4fe457d701 100644
> --- a/package/apache/apache.hash
> +++ b/package/apache/apache.hash
> @@ -1,4 +1,10 @@
> -# From http://archive.apache.org/dist/httpd/httpd-2.4.43.tar.bz2.sha256
> -sha256  a497652ab3fc81318cdc2a203090a999150d86461acff97c1065dc910fe10f43  httpd-2.4.43.tar.bz2
> +# From http://archive.apache.org/dist/httpd/httpd-2.4.46.tar.bz2.md5
> +md5  7d661ea5e736dac5e2761d9f49fe8361  httpd-2.4.46.tar.bz2
> +# From http://archive.apache.org/dist/httpd/httpd-2.4.46.tar.bz2.sha1
> +sha1  1b7cd10ff3a2a07a576d77e34f0204d95fa4aceb  httpd-2.4.46.tar.bz2
> +# From http://archive.apache.org/dist/httpd/httpd-2.4.46.tar.bz2.sha256
> +sha256  740eddf6e1c641992b22359cabc66e6325868c3c5e2e3f98faf349b61ecf41ea  httpd-2.4.46.tar.bz2
> +# From http://archive.apache.org/dist/httpd/httpd-2.4.46.tar.bz2.sha512
> +sha512  5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13  httpd-2.4.46.tar.bz2
>  # Locally computed
>  sha256  47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43  LICENSE
> diff --git a/package/apache/apache.mk b/package/apache/apache.mk
> index 068f36e325..203d637fbb 100644
> --- a/package/apache/apache.mk
> +++ b/package/apache/apache.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -APACHE_VERSION = 2.4.43
> +APACHE_VERSION = 2.4.46
>  APACHE_SOURCE = httpd-$(APACHE_VERSION).tar.bz2
>  APACHE_SITE = http://archive.apache.org/dist/httpd
>  APACHE_LICENSE = Apache-2.0
> -- 
> 2.27.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'


More information about the buildroot mailing list