-
Notifications
You must be signed in to change notification settings - Fork 160
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Pullup ticket #6865 - requested by taca
lang/php81: security fix
Revisions pulled up:
- lang/php/phpversion.mk 1.433
- lang/php81/Makefile 1.22-1.23
- lang/php81/Makefile.php 1.2
- lang/php81/distinfo 1.33
- lang/php81/patches/patch-build_php.m4 1.1
- lang/php81/patches/patch-configure deleted
- lang/php81/patches/patch-sapi_apache2handler_config.m4 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jun 7 13:54:25 UTC 2024
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php81: Makefile distinfo
Added Files:
pkgsrc/lang/php81/patches: patch-build_php.m4
patch-sapi_apache2handler_config.m4
Removed Files:
pkgsrc/lang/php81/patches: patch-configure
Log Message:
lang/php81: update to 8.1.29
pkgsrc change:
Instead of patch configure, patch m4 files and use autoconf to generate
configure.
PHP 8.1.29 (2024-06-06)
- CGI:
. Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
in PHP-CGI). (CVE-2024-4577) (nielsdos)
- Filter:
. Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
(CVE-2024-5458) (nielsdos)
- OpenSSL:
. The openssl_private_decrypt function in PHP, when using PKCS1 padding
(OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack
unless it is used with an OpenSSL version that includes the changes from this pull
request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection).
These changes are part of OpenSSL 3.2 and have also been backported to stable
versions of various Linux distributions, as well as to the PHP builds provided for
Windows since the previous release. All distributors and builders should ensure that
this version is used to prevent PHP from being vulnerable. (CVE-2024-2408)
- Standard:
. Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874).
(CVE-2024-5585) (nielsdos)
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jun 7 23:11:41 UTC 2024
Modified Files:
pkgsrc/lang/php81: Makefile Makefile.php
pkgsrc/lang/php82: Makefile Makefile.php
pkgsrc/lang/php83: Makefile Makefile.php
pkgsrc/www/ap-php: Makefile
pkgsrc/www/php-fpm: Makefile
Log Message:
Fix build problem of www/ap-php and www/php-fpm.
Switch these packages to use autoconf, too.- Loading branch information
Showing
7 changed files
with
66 additions
and
80 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| $NetBSD: patch-build_php.m4,v 1.1.2.2 2024/06/24 18:04:52 bsiegert Exp $ | ||
|
|
||
| Do not include "PKG_CONFIG*" in CONFIGURE_OPTIONS. | ||
|
|
||
| --- build/php.m4.orig 2024-06-05 05:51:57.000000000 +0000 | ||
| +++ build/php.m4 | ||
| @@ -2152,6 +2152,10 @@ EOF | ||
| else | ||
| break | ||
| fi | ||
| + case "$CURRENT_ARG" in | ||
| + \'PKG_CONFIG\=*) CURRENT_ARG="'PKG_CONFIG=@TOOLS_PATH.pkg-config@'";; | ||
| + \'PKG_CONFIG_LIBDIR\=*) CURRENT_ARG="'PKG_CONFIG_LIBDIR=@PHP_PKGCONFIG_PATH@'";; | ||
| + esac | ||
| AS_ECHO(["$CURRENT_ARG \\"]) >>$1 | ||
| CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS $CURRENT_ARG" | ||
| done |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| $NetBSD: patch-sapi_apache2handler_config.m4,v 1.1.2.2 2024/06/24 18:04:52 bsiegert Exp $ | ||
|
|
||
| Don't autodetect maintainer-zts. | ||
|
|
||
| --- sapi/apache2handler/config.m4.orig 2024-06-05 05:51:57.000000000 +0000 | ||
| +++ sapi/apache2handler/config.m4 | ||
| @@ -108,18 +108,6 @@ if test "$PHP_APXS2" != "no"; then | ||
| ;; | ||
| esac | ||
|
|
||
| - if test "$APACHE_VERSION" -lt 2004001; then | ||
| - APXS_MPM=`$APXS -q MPM_NAME` | ||
| - if test "$APXS_MPM" != "prefork" && test "$APXS_MPM" != "peruser" && test "$APXS_MPM" != "itk"; then | ||
| - PHP_BUILD_THREAD_SAFE | ||
| - fi | ||
| - else | ||
| - APACHE_THREADED_MPM=`$APXS_HTTPD -V 2>/dev/null | grep 'threaded:.*yes'` | ||
| - if test -n "$APACHE_THREADED_MPM"; then | ||
| - PHP_BUILD_THREAD_SAFE | ||
| - fi | ||
| - fi | ||
| - AC_MSG_RESULT(yes) | ||
| PHP_SUBST(APXS) | ||
| else | ||
| AC_MSG_RESULT(no) |