Groups > linux.debian.bugs.dist > #898759

Bug#894713: stretch-pu: apache2/2.4.25-3+deb9u5

From	Stefan Fritsch <sf@sfritsch.de>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#894713: stretch-pu: apache2/2.4.25-3+deb9u5
Date	2018-05-20 18:40 +0200
Message-ID	<vRzxf-6LT-3@gated-at.bofh.it> (permalink)
References	<vAtod-7V4-11@gated-at.bofh.it> <vP38t-5JQ-5@gated-at.bofh.it> <vAtod-7V4-11@gated-at.bofh.it> <vP38t-5JQ-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Hi,

On Sunday, 13 May 2018 19:15:22 CEST Stefan Fritsch wrote:
> On Tuesday, 3 April 2018 14:07:33 CEST Stefan Fritsch wrote:
> > I would like to do an upgrade of apache2 in stretch that upgrades the
> > complete mod_http2 and mod_proxy_http2 modules from the versions from
> > 2.4.25 to the versions from 2.4.33.
> > 
> > The reason is that the fix for CVE-2018-1302 [1] is difficult to
> > backport because it concerns a complex life-time issue of data
> > structures, the relevant code has changed greatly between 2.4.25 and
> > 2.4.33, and I am not familiar with the internals of mod_http2.  There
> > are other random segfaults [2] and other bugs [3] in stretch's mod_http2
> > that are reportedly fixed by newer mod_http2. Therefore, upgrading the
> > whole thing seems like the best solution to me. Do you agree with this
> > approach?
> 
> I have now prepared updated packages. The changelog diff is:

There is one complication: It turns out that in newer versions of apache2, 
mod_http2 does no longer support being used with mpm_prefork but only with 
mpm_worker and mpm_event. If loaded together with mpm_prefork, mod_http2 will 
log a message and refuse to serve HTTP/2, but HTTP/1.x continues to work.

As I don't see any other way to fix the open issues, I would still like to go 
ahead. But I will prepare a new package/diff with a NEWS.Debian entry that 
informs about this change.

Cheers,
Stefan

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#894713: stretch-pu: Pre-approval of package apache2/2.4.25-3+deb9u5 Stefan Fritsch <sf@sfritsch.de> - 2018-04-03 14:40 +0200
  Bug#894713: stretch-pu:  apache2/2.4.25-3+deb9u5 Stefan Fritsch <sf@sfritsch.de> - 2018-05-13 19:40 +0200
    Bug#894713: stretch-pu:  apache2/2.4.25-3+deb9u5 Stefan Fritsch <sf@sfritsch.de> - 2018-05-20 18:40 +0200

csiph-web