Changeset 2774 for trunk/server/common

Timestamp:

Jul 18, 2016, 7:53:10 PM (9 years ago)

Author:

andersk

Message:

Apply the 2015 suexec patch for CVE-2016-5387 “httpoxy”.

Also remove our inexplicable whitelist entry for HTTPS_* environment
variables.

Location:

trunk/server/common/patches

Files:

• httpd-suexec-CVE-2016-5387.patch (added)
• httpd-suexec-scripts.patch (modified) (1 diff)

trunk/server/common/patches/httpd-suexec-scripts.patch

@@ -52 +52 @@
  #include "ap_config.h"
  #include "suexec.h"
-@@ -92,6 +95,7 @@ static const char *const safe_env_lst[] =
- {
-     /* variable name starts with */
-     "HTTP_",
-+    "HTTPS_",
-     "SSL_",
- 
-     /* variable name is */
 @@ -268,9 +272,108 @@ static void clean_env(void)
      environ = cleanenv;