new version 2.4.54

fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719

.gitignore

@@ -43,3 +43,5 @@ x86_64
 /httpd-2.4.50.tar.bz2.asc
 /httpd-2.4.51.tar.bz2.asc
 /httpd-2.4.52.tar.bz2.asc
+/httpd-2.4.53.tar.bz2.asc
+/httpd-2.4.54.tar.bz2.asc

httpd-2.4.53-detect-systemd.patch

@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index 0b088ac..9eeb5c7 100644
+index a2e9c82..bd8045c 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
@@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
 diff --git a/acinclude.m4 b/acinclude.m4
-index 2a7e5d1..eb28321 100644
+index 97484c9..05abe18 100644
 --- a/acinclude.m4
 +++ b/acinclude.m4
-@@ -624,6 +624,7 @@ case $host in
+@@ -631,6 +631,7 @@ case $host in
        if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
          AC_MSG_WARN([Your system does not support systemd.])
        else
@@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644
        fi
     fi
 diff --git a/configure.in b/configure.in
-index 3618a5a..74a782b 100644
+index cf437fe..521fc45 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then
    AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
    APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`])
 +  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
  else
-   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+   AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/])
  fi
-@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR)
+@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR)
  APACHE_SUBST(BUILTIN_LIBS)
  APACHE_SUBST(SHLIBPATH_VAR)
  APACHE_SUBST(OS_SPECIFIC_VARS)

httpd-2.4.53-export.patch

@@ -1,12 +1,5 @@
-
-Reduce size of httpd binary by telling linker to export all symbols
-from libmain.a, rather than bloating the symbol table with ap_hack_*
-to do so indirectly.
-
-Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
-
 diff --git a/Makefile.in b/Makefile.in
-index 40c7076..ac98e5f 100644
+index bd8045c..d6733a5 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
@@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644
  	eoc_bucket.c eor_bucket.c core_filters.c \
  	util_expr_parse.c util_expr_scan.c util_expr_eval.c
 diff --git a/server/main.c b/server/main.c
-index 62e06df..17c09ee 100644
+index 7da7aa2..e63d2eb 100644
 --- a/server/main.c
 +++ b/server/main.c
-@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
+@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[])
      return !OK;
  }
  

httpd-2.4.54-selinux.patch

@@ -1,8 +1,8 @@
 diff --git a/configure.in b/configure.in
-index c8f9aa2..cb43246 100644
+index 74015ca..8c0ee10 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -484,6 +484,11 @@ getloadavg
+@@ -508,6 +508,11 @@ getloadavg
  dnl confirm that a void pointer is large enough to store a long integer
  APACHE_CHECK_VOID_PTR_LEN
  
@@ -15,10 +15,10 @@ index c8f9aa2..cb43246 100644
  [AC_TRY_RUN(#define _GNU_SOURCE
  #include <unistd.h>
 diff --git a/server/core.c b/server/core.c
-index dc0f17a..7ed9527 100644
+index a6fa2fb..cf4cba4 100644
 --- a/server/core.c
 +++ b/server/core.c
-@@ -59,6 +59,10 @@
+@@ -65,6 +65,10 @@
  #include <unistd.h>
  #endif
  
@@ -28,8 +28,8 @@ index dc0f17a..7ed9527 100644
 +
  /* LimitRequestBody handling */
  #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
- #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
-@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
+ #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 1<<30) /* 1GB */
+@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
      }
  #endif
  

httpd.spec

@@ -12,7 +12,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.52
+Version: 2.4.54
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -66,13 +66,13 @@ Source48: apache-poweredby.png
 Patch2: httpd-2.4.43-apxs.patch
 Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.43-detect-systemd.patch
+Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
 Patch21: httpd-2.4.48-r1842929+.patch
 Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.48-export.patch
+Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
-Patch25: httpd-2.4.43-selinux.patch
+Patch25: httpd-2.4.54-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
@@ -787,6 +787,13 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jun 27 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-1
+- new version 2.4.54
+
+* Thu Mar 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-1
+- new version 2.4.53
+- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719
+
 * Wed Dec 22 2021 Joe Orton <jorton@redhat.com> - 2.4.52-1
 - update to 2.4.52
 

sources

@@ -1,3 +1,3 @@
+SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18
+SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
-SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6
-SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05