helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-08-15 16:29:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

apache2: CVE-2018-1333

Browse Source 
* fixes a race condition where aborting streams triggers an
 unnecessary timeout.

Affects apache2 2.4.18 to 2.4.30 and apache2 2.4.33

Fixed in apache2 2.4.34

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Jagadeesh Krishnanjanappa 2018-08-23 16:51:22 +05:30 committed by Armin Kuster
parent 280157bc38
commit 086be3c7ec
3 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta-webserver/recipes-httpd/apache2/apache2-native_2.4.27.bb
View File

@ -10,6 +10,7 @@ inherit autotools pkgconfig native
SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
file://0001-configure-use-pkg-config-for-PCRE-detection.patch \ file://0001-configure-use-pkg-config-for-PCRE-detection.patch \
file://CVE-2018-1333.patch \
" "
S = "${WORKDIR}/httpd-${PV}" S = "${WORKDIR}/httpd-${PV}"

1
meta-webserver/recipes-httpd/apache2/apache2_2.4.27.bb
View File

@ -21,6 +21,7 @@ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
file://apache2-volatile.conf \ file://apache2-volatile.conf \
file://apache2.service \ file://apache2.service \
file://volatiles.04_apache2 \ file://volatiles.04_apache2 \
file://CVE-2018-1333.patch \
" "
LIC_FILES_CHKSUM = "file://LICENSE;md5=dbff5a2b542fa58854455bf1a0b94b83" LIC_FILES_CHKSUM = "file://LICENSE;md5=dbff5a2b542fa58854455bf1a0b94b83"

44
meta-webserver/recipes-httpd/apache2/files/CVE-2018-1333.patch Normal file
View File

@ -0,0 +1,44 @@
From 83a2e3866918ce6567a683eb4c660688d047ee81 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan.eissing@greenbytes.de>
Date: Wed, 18 Apr 2018 11:55:17 +0200
Subject: [PATCH] * fixes a race condition where aborting streams triggers an
unnecessary timeout.
Note: Re-factored upstream fix
https://github.com/icing/mod_h2/commit/83a2e3866918ce6567a683eb4c660688d047ee81,
so that it applies to httpd v2.4.27 code. Similarly done at
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/http2/h2_bucket_beam.c?r1=1828879&r2=1828878&pathrev=1828879
CVE: CVE-2018-1333
Upstream-Status: Backport [https://github.com/icing/mod_h2/commit/83a2e3866918ce6567a683eb4c660688d047ee81]
Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
diff -Naurp httpd-2.4.27_org/modules/http2/h2_bucket_beam.c httpd-2.4.27/modules/http2/h2_bucket_beam.c
--- httpd-2.4.27_org/modules/http2/h2_bucket_beam.c 2017-04-21 06:52:05.000000000 -0700
+++ httpd-2.4.27/modules/http2/h2_bucket_beam.c 2018-07-24 23:44:40.888330955 -0700
@@ -512,6 +512,7 @@ static void recv_buffer_cleanup(h2_bucke
apr_brigade_destroy(bb);
if (bl) enter_yellow(beam, bl);
+ apr_thread_cond_broadcast(beam->change);
if (beam->cons_ev_cb) {
beam->cons_ev_cb(beam->cons_ctx, beam);
}
@@ -685,12 +686,10 @@ void h2_beam_abort(h2_bucket_beam *beam)
h2_beam_lock bl;
if (enter_yellow(beam, &bl) == APR_SUCCESS) {
- if (!beam->aborted) {
- beam->aborted = 1;
- r_purge_sent(beam);
- h2_blist_cleanup(&beam->send_list);
- report_consumption(beam, &bl);
- }
+ beam->aborted = 1;
+ r_purge_sent(beam);
+ h2_blist_cleanup(&beam->send_list);
+ report_consumption(beam, &bl);
if (beam->cond) {
apr_thread_cond_broadcast(beam->cond);
}