diff --git a/httpd-2.4.64-r1927270.patch b/httpd-2.4.64-r1927270.patch deleted file mode 100644 index 21b2b9dcb49d6d1fc24275606084d0a4de345916..0000000000000000000000000000000000000000 --- a/httpd-2.4.64-r1927270.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 6e59b124221014bd1c23053e9bb63fb3362387d9 Mon Sep 17 00:00:00 2001 -From: Eric Covener -Date: Wed, 16 Jul 2025 17:33:21 +0000 -Subject: [PATCH] rc already is set by result of expression eval - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1927270 13f79535-47bb-0310-9956-ffa450edef68 ---- - modules/mappers/mod_rewrite.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index a6c35a0be1f..a71110bc76e 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -4283,9 +4283,6 @@ static cond_return_type apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ct - p->pattern - p->pskip, err); - rc = COND_RC_NOMATCH; - } -- else { -- rc = COND_RC_MATCH; -- } - /* update briRC backref info */ - if (rc && !(p->flags & CONDFLAG_NOTMATCH)) { - ctx->briRC.source = source; - diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch new file mode 100644 index 0000000000000000000000000000000000000000..315b9c22aec19a90853c5d1114edfd4a30ace8dc --- /dev/null +++ b/httpd-2.4.65-hcheck-stuck.patch @@ -0,0 +1,66 @@ +--- a/modules/proxy/mod_proxy_hcheck.c ++++ b/modules/proxy/mod_proxy_hcheck.c +@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state + sctx_t *ctx = (sctx_t *)data; + server_rec *s = ctx->s; + proxy_server_conf *conf; ++ proxy_worker **workers; ++ proxy_worker *worker; ++ apr_time_t now; ++ int i, n; + ++ conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); ++ balancer = (proxy_balancer *)conf->balancers->elts; ++ + switch (state) { + case AP_WATCHDOG_STATE_STARTING: + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258) + "%s watchdog started.", + HCHECK_WATHCHDOG_NAME); ++ /* set last update time for all workers */ ++ now = apr_time_now(); ++ for (i = 0; i < conf->balancers->nelts; i++, balancer++) { ++ workers = (proxy_worker **)balancer->workers->elts; ++ for (n = 0; n < balancer->workers->nelts; n++, ++workers) { ++ worker = *workers; ++ if (worker->s->updated == 0) { ++ worker->s->updated = now; ++ } ++ } ++ } + #if HC_USE_THREADS + if (tpsize && hctp == NULL) { + rv = apr_thread_pool_create(&hctp, tpsize, +@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state + + case AP_WATCHDOG_STATE_RUNNING: + /* loop thru all workers */ +- if (s) { +- int i; +- conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); +- balancer = (proxy_balancer *)conf->balancers->elts; +- ctx->s = s; ++ { ++ now = apr_time_now(); + for (i = 0; i < conf->balancers->nelts; i++, balancer++) { +- int n; +- apr_time_t now; +- proxy_worker **workers; +- proxy_worker *worker; + /* Have any new balancers or workers been added dynamically? */ + ap_proxy_sync_balancer(balancer, s, conf); + workers = (proxy_worker **)balancer->workers->elts; +- now = apr_time_now(); +- for (n = 0; n < balancer->workers->nelts; n++) { ++ for (n = 0; n < balancer->workers->nelts; n++, workers++) { + worker = *workers; + if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) && + (worker->s->method != NONE) && +@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state + hc_check(NULL, baton); + } + } +- workers++; + } + } + } diff --git a/httpd-2.4.64.tar.bz2 b/httpd-2.4.66.tar.bz2 similarity index 48% rename from httpd-2.4.64.tar.bz2 rename to httpd-2.4.66.tar.bz2 index 55fbcf3c35660d18e55aa3c7922b7b5e3d05b367..c99d85272065ed8f21eefb72cc806f3ec7c1c8bc 100644 Binary files a/httpd-2.4.64.tar.bz2 and b/httpd-2.4.66.tar.bz2 differ diff --git a/httpd.conf b/httpd.conf index 609b2e2d93017df63172c762f96d2c542fede5f0..d2865488a18782bb09c5e3075e8ea9bd8f1a60ba 100644 --- a/httpd.conf +++ b/httpd.conf @@ -199,6 +199,7 @@ LogLevel warn # a CustomLog directive (see below). # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext LogFormat "%h %l %u %t \"%r\" %>s %b" common @@ -216,10 +217,11 @@ LogLevel warn #CustomLog "logs/access_log" common # - # If you prefer a logfile with access, agent, and referer information - # (Combined Logfile Format) you can use the following directive. + # If you prefer a logfile with access, agent, referer, and process/thread + # information (an extended Combined Logfile Format), you can use the + # following directive. # - CustomLog "logs/access_log" combined + CustomLog "logs/access_log" combined_ext diff --git a/httpd.spec b/httpd.spec index fe42e09fa0965cc68b8bba93baa8c5a71da78f64..e12ca0115e1f7ead243488f56b06a311351f44a4 100644 --- a/httpd.spec +++ b/httpd.spec @@ -14,7 +14,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.64 +Version: 2.4.66 Release: %{anolis_release}%{?dist} License: ASL 2.0 URL: https://httpd.apache.org/ @@ -69,14 +69,14 @@ Patch0004: httpd-2.4.48-r1842929+.patch Patch0005: httpd-2.4.64-mod_systemd.patch Patch0006: httpd-2.4.53-export.patch Patch0007: httpd-2.4.43-corelimit.patch -Patch0010: httpd-2.4.54-icons.patch -Patch0011: httpd-2.4.43-cachehardmax.patch -Patch0013: httpd-2.4.43-sslciphdefault.patch -Patch0014: httpd-2.4.64-sslprotdefault.patch -Patch0017: httpd-2.4.43-logjournal.patch -Patch0018: httpd-2.4.64-separate-systemd-fns.patch -Patch0019: httpd-2.4.43-enable-sslv3.patch -Patch0023: httpd-2.4.64-r1927270.patch +Patch0008: httpd-2.4.54-icons.patch +Patch0009: httpd-2.4.43-cachehardmax.patch +Patch0010: httpd-2.4.43-sslciphdefault.patch +Patch0011: httpd-2.4.64-sslprotdefault.patch +Patch0012: httpd-2.4.43-logjournal.patch +Patch0013: httpd-2.4.64-separate-systemd-fns.patch +Patch0014: httpd-2.4.43-enable-sslv3.patch +Patch0015: httpd-2.4.65-hcheck-stuck.patch # modify for anolis Patch1000: 1000-httpd-anolis-rebrand.patch @@ -755,6 +755,9 @@ exit $rv %changelog +* Thu Dec 11 2025 YangCheng - 2.4.66-1 +- update to 2.4.66 to fix CVE-2025-58098 CVE-2025-55753 + * Fri Aug 22 2025 wenxin - 2.4.64-1 - update to 2.4.64 to fix cves - fix CVE-2024-43204 diff --git a/httpd.tmpfiles b/httpd.tmpfiles index f148886490e03cae4ec0381687638213074e8de1..a845ab51e3402f389f3c4c8a7efd83dbe8c53b9c 100644 --- a/httpd.tmpfiles +++ b/httpd.tmpfiles @@ -1,2 +1,9 @@ d /run/httpd 710 root apache d /run/httpd/htcacheclean 700 apache apache +d /var/log/httpd 700 root root - +d /var/www 755 root root - +d /var/www/html 755 root root - +d /var/www/cgi-bin 755 root root - +d /var/lib/httpd 700 apache apache - +d /var/cache/httpd 700 apache apache - +d /var/cache/httpd/proxy 700 apache apache -