Bugzilla Bug 62626

Hope this isn't a dupe again ;-) but I couldn't find the patch from the apache
bugzilla being used.
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964

Debian fixed it with this upload on 23 Aug:
"apache2 (2.0.50-11) unstable; urgency=high
 .
   * Add two patches from upstream to address two vulnerabilities in mod_ssl:
     - CAN-2004-0748 is a potential infinite loop in the SSL input filter
       which can be triggered by an aborted connection.
     - CAN-2004-0751 is a potential segfault in the SSL input filter which
       can be triggered by the response to request which is proxied to a
       remote SSL server.
"

The RH advisory (errata) reads as follows:

Updated httpd packages fix mod_ssl security flaw
Advisory:       RHSA-2004:349-10
Last updated on:        2004-09-01
CVEs (cve.mitre.org):   CAN-2004-0748

[...]

Details:

Updated httpd packages that include a security fix for mod_ssl and various
enhancements are now available.

The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.

An input filter bug in mod_ssl was discovered in Apache httpd version
2.0.50 and earlier. A remote attacker could force an SSL connection to be
aborted in a particular state and cause an Apache child process to enter an
infinite loop, consuming CPU resources. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0748 to
this issue.

Additionally, this update includes the following enhancements and bug fixes:
[...]

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0748
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964

*** Bug 62623 has been marked as a duplicate of this bug. ***

Zul: this one if for you. 2.0.50-r1 is needed :)

zul is not responding, please bump.

Please assign Apache security bugs to the apache herd next time ;-)

Best regards,
Stu

Thanks to ferringb's help to work around a repoman bug, apache-2.0.50-r1 is now
in the tree, and ready for the arch teams to do their stuff.

Best regards,
Stu

Arches please mark apache-2.0.50-r1 stable

sparc stable.

ppc stable

x86 stable

Stable on alpha.

amd64/arm/hppa/ia64 stable now ... was there a particular reason 2.0.50-r1
didnt have ~ KEYWORDS in them ?  i would have noticed the upgrade on all my
machines a lot earlier if it had ...

Stable on mips.

This only fixed CAN-2004-0748 afaik. There is still CAN-2004-0751 as mentioned
in the debian changelog and this Secunia advisory:
http://secunia.com/advisories/12434/

Debian seems to patch CAN-2004-0751 with "diff -u -r1.125 -r1.126" as proposed
in 
http://issues.apache.org/bugzilla/show_bug.cgi?id=30134

apache-bugs please confirm that CAN-2004-0751 is also fixed or apply patches.

Secunia propose these two patches to fix the issues:

http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.121&r2=1.122

http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.125&r2=1.126

*** Bug 63605 has been marked as a duplicate of this bug. ***

Patches updated; added to apache-2.0.50-r2.

Best regards,
Stu

arches, please mark apache-2.0.50-r2 stable

current KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
target KEYWORDS="x86 ppc sparc mips alpha arm hppa amd64 ia64 s390 ppc64"

Sparc stable.

stable on ppc

Stable on hppa.

Stable on amd64

Arches: due to bug 63948, we'll have to issue a new rev for Apache2, so you can
stop testing the current one... Sorry about that.

2.0.50-r3 is in... that version should be marked stable to also fix bug 63948

Sparc done with -r3.

stable on ppc. 

stable on amd64.

Apache herd: i get 13 file.size complaints from repoman FYI !

You've got around 450kB uncompressed patches in the tree ! (and that's only the sum of those files which are larger than 20kb)

Stable on hppa.

x86 and amd64 please mark apache-2.0.50-r3 stable
x86, please also mark net-www/mod_dav-1.0.3-r2 stable for bug #63948, so that an GLSA for these issues can be sent, since this bug was opened 2004-09-02
---
status apache-2.0.50-r2 :

current KEYWORDS="~alpha ~amd64 arm hppa ia64 ~mips ppc ~ppc64 sparc ~x86"
target KEYWORDS="alpha amd64 arm hppa ia64 mips ppc  ppc64 sparc s390 x86"

---
btw net-www/mod_dav-1.0.3-r2 is marked ~amd64 which just got introduced in this revision

-r3 is stable on amd64.

apache-2.0.51 is now in the tree.  We need another round of stable marking, and
I suggest the GLSA goes out suggesting everyone goes from .50 straight to .51.

Best regards,
Stu

Welcome to a new round of stable marking...
Thanks to bug #64145 it's time for a run on apache-2.0.51.

current KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
target KEYWORDS="alpha amd64 arm hppa ia64 mips ppc  ppc64 sparc s390 x86"


Better hurry before the next one comes... ;-)

stable on ppc

Stable on x86.

Kugelfang reports that -51 doesn't start on amd64, but he's had no time to investigate why.  So atm we don't know whether it's a config problem or a code problem.

Best regards,
Stu

apache-2.0.51 sparc stable.

x86 has both apache 2.0.51 and mod_dav 1.0.3-r2 stable..

Kugelfang marked 2.0.51 on amd64, this is GLSA-ready

GLSA 200409-21
alpha arm hppa ia64 mips ppc64 s390 : please mark stable to benefit from GLSA

Forced quick stablilisation on hppa ...

ppc64 stable.

Stable on alpha.

mips stable.