search

iusrepo / httpd24u

Apache HTTP Server
17 stars 14 forks source link

Update to 2.4.41 #31

Closed futureweb closed 5 years ago

futureweb commented 5 years ago

Latest Upstream, Security Fixes - HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion (https://www.kb.cert.org/vuls/id/605641/) Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.41

liamsorsby commented 5 years ago

Given there has been a fair amount of CVE's raised due to broken http2 implementations. I would have thought it best to merge this in ASAP. @carlwgeorge, are you okay for me to just merge this in?

carlwgeorge commented 5 years ago

Thanks @futureweb for the pull request, and thanks @liamsorsby for adding your review.

I squashed these commits together and made a small tweak to remove the trailing .ius in the changelog entry. We used to include that, but it's not necessary. We used to hard code .ius in the release field, but now it's added by overriding the %dist macro during the build.

The build completed successfully, and I've signed and published the httpd24u-2.4.41-1 RPMs to the testing repos. Try them out and share your feedback. As soon as someone confirms these work as expected, I'll publish them to the stable repos.

futureweb commented 5 years ago

@carlwgeorge - alright! Looking good - running stable on our Dev Server! ;-)

carlwgeorge commented 5 years ago

Thanks for the confirmation. I've pushed this to the stable repo.

gpgkd906 commented 5 years ago

Thanks for the confirmation. I've pushed this to the stable repo.

need help, i can't see this... with centos 7, and i updated the ius-release.rpm...

yum update https://centos7.iuscommunity.org/ius-release.rpm
yum --disablerepo=base,extras,updates --enablerepo=ius info httpd24u
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * ius: syd.mirror.rackspace.com
 * remi-safe: ftp.riken.jp
Installed Packages
Name        : httpd24u
Arch        : x86_64
Version     : 2.4.39
Release     : 1.ius.centos7
Size        : 4.3 M
Repo        : installed
From repo   : ius
Summary     : Apache HTTP Server
URL         : https://httpd.apache.org/
License     : ASL 2.0
Description : The Apache HTTP Server is a powerful, efficient, and extensible
            : web server.
carlwgeorge commented 5 years ago

@gpgkd906

ius: syd.mirror.rackspace.com

That line means you are not using the new CDN baseurl that is the default in the latest ius-release package. You are either still utilizing the old mirrorlist setting, or have manually edited /etc/yum.repos.d/ius.repo to point directly to syd.mirror.rackspace.com. Either way, make sure you have ius-release-2-1, and that you have merged any rpmnew files in /etc/yum.repos.d/.