diff mbox

[1/1] gnu: httpd: Fix CVE-2016-8740.

Message ID 9c1156dad85b54e71fca1a73ec8f24e31f82d8e4.1481009302.git.leo@famulari.name
State New
Headers show

Commit Message

Leo Famulari Dec. 6, 2016, 7:28 a.m. UTC
* gnu/packages/patches/httpd-cve-2016-8740.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/web.scm (httpd)[source]: Use it.
---
 gnu/local.mk                                   |  1 +
 gnu/packages/patches/httpd-cve-2016-8740.patch | 43 ++++++++++++++++++++++++++
 gnu/packages/web.scm                           |  1 +
 3 files changed, 45 insertions(+)
 create mode 100644 gnu/packages/patches/httpd-cve-2016-8740.patch

Comments

Ludovic Courtès Dec. 6, 2016, 9:24 a.m. UTC | #1
Leo Famulari <leo@famulari.name> skribis:

> * gnu/packages/patches/httpd-cve-2016-8740.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/web.scm (httpd)[source]: Use it.

[...]

> --- /dev/null
> +++ b/gnu/packages/patches/httpd-cve-2016-8740.patch

Please make it a capital “CVE” to placate ‘guix lint -c cve’.

Otherwise LGTM, thanks!

Ludo’.
Leo Famulari Dec. 6, 2016, 3:14 p.m. UTC | #2
On Tue, Dec 06, 2016 at 10:24:58AM +0100, Ludovic Courtès wrote:
> Leo Famulari <leo@famulari.name> skribis:
> 
> > * gnu/packages/patches/httpd-cve-2016-8740.patch: New file.
> > * gnu/local.mk (dist_patch_DATA): Add it.
> > * gnu/packages/web.scm (httpd)[source]: Use it.
> 
> [...]
> 
> > --- /dev/null
> > +++ b/gnu/packages/patches/httpd-cve-2016-8740.patch
> 
> Please make it a capital “CVE” to placate ‘guix lint -c cve’.
> 
> Otherwise LGTM, thanks!

Efraim beat me to it! Thanks Efraim!
diff mbox

Patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 96689a7d6..3643fdfd6 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -620,6 +620,7 @@  dist_patch_DATA =						\
   %D%/packages/patches/hdf-eos5-fortrantests.patch		\
   %D%/packages/patches/higan-remove-march-native-flag.patch	\
   %D%/packages/patches/hop-linker-flags.patch			\
+  %D%/packages/patches/httpd-cve-2016-8740.patch		\
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
   %D%/packages/patches/hypre-doc-tables.patch			\
   %D%/packages/patches/hypre-ldflags.patch			\
diff --git a/gnu/packages/patches/httpd-cve-2016-8740.patch b/gnu/packages/patches/httpd-cve-2016-8740.patch
new file mode 100644
index 000000000..6988bc337
--- /dev/null
+++ b/gnu/packages/patches/httpd-cve-2016-8740.patch
@@ -0,0 +1,43 @@ 
+Fix CVE-2016-8740 (mod_http2: properly crafted, endless HTTP/2 CONTINUATION
+frames could be used to exhaust all server's memory.):
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740
+https://httpd.apache.org/security/vulnerabilities_24.html
+
+Patched copied from upstream mailing list:
+https://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E
+
+Index: modules/http2/h2_stream.c
+===================================================================
+--- a/modules/http2/h2_stream.c	(revision 1771866)
++++ b/modules/http2/h2_stream.c	(working copy)
+@@ -322,18 +322,18 @@
+                                            HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE);
+             }
+         }
+-    }
+-    
+-    if (h2_stream_is_scheduled(stream)) {
+-        return h2_request_add_trailer(stream->request, stream->pool,
+-                                      name, nlen, value, vlen);
+-    }
+-    else {
+-        if (!input_open(stream)) {
+-            return APR_ECONNRESET;
++        
++        if (h2_stream_is_scheduled(stream)) {
++            return h2_request_add_trailer(stream->request, stream->pool,
++                                          name, nlen, value, vlen);
+         }
+-        return h2_request_add_header(stream->request, stream->pool,
+-                                     name, nlen, value, vlen);
++        else {
++            if (!input_open(stream)) {
++                return APR_ECONNRESET;
++            }
++            return h2_request_add_header(stream->request, stream->pool,
++                                         name, nlen, value, vlen);
++        }
+     }
+ }
+ 
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 697bab8e5..0162072c6 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -90,6 +90,7 @@ 
              (method url-fetch)
              (uri (string-append "mirror://apache/httpd/httpd-"
                                  version ".tar.bz2"))
+             (patches (search-patches "httpd-cve-2016-8740.patch"))
              (sha256
               (base32
                "0n2yx3gjlpr4kgqx845fj6amnmg25r2l6a7rzab5hxnpmar985hc"))))