Log message:
Pullup ticket #6739 - requested by taca
www/apache24: security update

Revisions pulled up:
- www/apache24/Makefile                                         1.115
- www/apache24/PLIST                                            1.36
- www/apache24/distinfo                                         1.54
- www/apache24/patches/patch-configure                          1.3

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Fri Jan 20 14:03:16 UTC 2023

   Modified Files:
   	pkgsrc/www/apache24: Makefile PLIST distinfo
   	pkgsrc/www/apache24/patches: patch-configure

   Log message:
   apache24: updated to 2.4.55

   Changes with Apache 2.4.55

     *) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
        2.4.55 allows a backend to trigger HTTP response splitting
        (cve.mitre.org)
        Prior to Apache HTTP Server 2.4.55, a malicious backend can
        cause the response headers to be truncated early, resulting in
        some headers being incorporated into the response body. If the
        later headers have any security purpose, they will not be
        interpreted by the client.
        Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)

     *) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
        Possible request smuggling (cve.mitre.org)
        Inconsistent Interpretation of HTTP Requests ('HTTP Request
        Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
        allows an attacker to smuggle requests to the AJP server it
        forwards requests to.  This issue affects Apache HTTP Server
        Apache HTTP Server 2.4 version 2.4.54 and prior versions.
        Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
        at Qi'anxin Group

     *) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
        of zero byte (cve.mitre.org)
        A carefully crafted If: request header can cause a memory read,
        or write of a single zero byte, in a pool (heap) memory location
        beyond the header value sent. This could cause the process to
        crash.
        This issue affects Apache HTTP Server 2.4.54 and earlier.

     *) mod_dav: Open the lock database read-only when possible.

     *) mod_proxy_http2: apply the standard httpd content type handling
        to responses from the backend, as other proxy modules do.

     *) mod_dav: mod_dav overrides dav_fs response on PUT failure.

     *) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]

     *) mod_http2: version 2.0.10 of the module, synchronizing changes
        with the gitgub version. This is a partial rewrite of how connections
        and streams are handled.
        - an APR pollset and pipes (where supported) are used to monitor
          the main connection and react to IO for request/response handling.
          This replaces the stuttered timed waits of earlier versions.
        - H2SerializeHeaders directive still exists, but has no longer an effect.
        - Clients that seemingly misbehave still get less resources allocated,
          but ongoing requests are no longer disrupted.
        - Fixed an issue since 1.15.24 that "Server" headers in \ 
proxied requests
          were overwritten instead of preserved.
        - A regression in v1.15.24 was fixed that could lead to httpd child
          processes not being terminated on a graceful reload or when reaching
          MaxConnectionsPerChild. When unprocessed h2 requests were queued at
          the time, these could stall.
        - Improved information displayed in 'server-status' for H2 connections when
          Extended Status is enabled. Now one can see the last request that IO
          operations happened on and transferred IO stats are updated as well.
        - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 \ 
connection
          send a GOAWAY frame much too early on new connections, leading to invalid
          protocol state and a client failing the request.
          The module now initializes the HTTP/2 protocol correctly and allows the
          client to submit one request before the shutdown via a GOAWAY frame
          is being announced.
        - :scheme pseudo-header values, not matching the
          connection scheme, are forwarded via absolute uris to the
          http protocol processing to preserve semantics of the request.
          Checks on combinations of pseudo-headers values/absence
          have been added as described in RFC 7540. Fixes #230.
        - A bug that prevented trailers (e.g. HEADER frame at the end) to be
          generated in certain cases was fixed. See #233 where it prevented
          gRPC responses to be properly generated.
        - Request and response header values are automatically stripped of leading
          and trialing space/tab characters. This is equivalent behaviour to what
          Apache httpd's http/1.1 parser does.
          The checks for this in nghttp2 v1.50.0+ are disabled.
        - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
          on the v2.0.x versions for stability. Many thanks!
     *) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
        request ':authority' is known. Improved test case that did not catch that
        the previous 'fix' was incorrect.

     *) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
        using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]

     *) mod_proxy: The AH03408 warning for a forcibly closed backend
        connection is now logged at INFO level.  [Yann Ylavic]

     *) mod_ssl: When dumping the configuration, the existence of
        certificate/key files is no longer tested.  [Joe Orton]

     *) mod_authn_core: Add expression support to AuthName and AuthType.
        [Graham Leggett]

     *) mod_ssl: when a proxy connection had handled a request using SSL, an
        error was logged when "SSLProxyEngine" was only configured in the
        location/proxy section and not the overall server. The connection
        continued to work, the error log was in error.

     *) mod_proxy_hcheck: Re-enable workers in standard ERROR state.

     *) mod_proxy_hcheck: Detect AJP/CPING support correctly.

     *) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]

     *) mod_md: a new directive `MDStoreLocks` can be used on cluster
        setups with a shared file system for `MDStoreDir` to order
        activation of renewed certificates when several cluster nodes are
        restarted at the same time. Store locks are not enabled by default.
        Restored curl_easy cleanup behaviour from v2.4.14 and refactored
        the use of curl_multi for OCSP requests to work with that.
        Fixes <https://github.com/icing/mod_md/issues/293>.

     *) core: Avoid an overflow on large inputs in ap_is_matchexp.

     *) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
        storage instead of slotmem. Needed after setting
        HeartbeatMaxServers default to the documented value 10 in 2.4.54.

     *) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
        This is a game changer for performances if client use PROPFIND a lot.

   To generate a diff of this commit:
   cvs rdiff -u -r1.114 -r1.115 pkgsrc/www/apache24/Makefile
   cvs rdiff -u -r1.35 -r1.36 pkgsrc/www/apache24/PLIST
   cvs rdiff -u -r1.53 -r1.54 pkgsrc/www/apache24/distinfo
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/www/apache24/patches/patch-configure