Your message dated Mon, 02 Jul 2018 16:47:10 +0000 with message-id <e1fa1yo-000arx...@fasolo.debian.org> and subject line Bug#897218: fixed in apache2 2.4.25-3+deb9u5 has caused the Debian Bug report #897218, regarding apache2: mod_http2 (32-bit, i386) segmentation fault while delivering large (2+ GiB) file to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 897218: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897218 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: apache2 Version: 2.4.25-3+deb9u4 Severity: normal Tags: patch upstream While downloading a large (2200 MiB) file via HTTP/2.0, apache2 2.4.33 (Debian unstable) reproducibly segfaults after delivering ~89% (1975 MiB) on 32-bit i386. apache2 2.4.25-3+deb9u4 (Debian stable) exhibits a slightly different failure mode, which is however assumed to originate in the same upstream bug. Steps to reproduce: - Install Debian unstable i386 in the "webserver" configuration, which installs apache2 2.4.33. Install curl. (Firefox or Chrome works as well.) - Enable SSL: * a2enmod ssl * a2ensite default-ssl - Enable HTTP/2.0: * echo 'Protocols h2 h2c http/1.1' > /etc/apache2/mods-available/http2.conf * a2enmod http2 - Restart Apache: systemctl restart apache2 - Create test file in /var/www/html: * dd if=/dev/zero of=/var/www/html/2200Mfile bs=1M count=2200 - Download the test file via curl (--http2 is redundant because curl uses HTTP/2.0 anyways if it's available; --insecure is necessary because the above steps do not install a proper SSL cert): * curl --http2 --insecure -o /dev/null https://localhost/2200Mfile % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 89 2200M 89 1975M 0 0 22.2M 0 0:01:38 0:01:28 0:00:10 25.8M curl: (56) Unexpected EOF - Apache's error.log: [Wed Apr 25 11:17:05.749002 2018] [core:notice] [pid 398:tid 3082986688] AH00052: child pid 646 exit signal Segmentation fault (11) Side note: On 64-bit, everything works as expected. This seems to be a 32-bit related bug. This bug has been reported upstream, where Stefan Eissing already landed a fix in apache2 trunk and suggested a backport to apache2 2.4.x: https://bz.apache.org/bugzilla/show_bug.cgi?id=62325 -- Package-specific info: -- System Information: Debian Release: 9.4 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 4.9.0-6-686-pae (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages apache2 depends on: ii apache2-bin 2.4.25-3+deb9u4 ii apache2-data 2.4.25-3+deb9u4 ii apache2-utils 2.4.25-3+deb9u4 ii dpkg 1.18.24 ii init-system-helpers 1.48 ii lsb-base 9.20161125 ii mime-support 3.60 ii perl 5.24.1-3+deb9u3 ii procps 2:3.3.12-3 Versions of packages apache2 recommends: ii ssl-cert 1.0.39 Versions of packages apache2 suggests: ii apache2-doc 2.4.25-3+deb9u4 pn apache2-suexec-pristine | apache2-suexec-custom <none> ii lynx [www-browser] 2.8.9dev11-1 ii w3m [www-browser] 0.5.3-34+deb9u1 Versions of packages apache2-bin depends on: ii libapr1 1.5.2-5 ii libaprutil1 1.5.4-3 ii libaprutil1-dbd-sqlite3 1.5.4-3 ii libaprutil1-ldap 1.5.4-3 ii libc6 2.24-11+deb9u3 ii libldap-2.4-2 2.4.44+dfsg-5+deb9u1 ii liblua5.2-0 5.2.4-1.1+b2 ii libnghttp2-14 1.18.1-1 ii libpcre3 2:8.39-3 ii libssl1.0.2 1.0.2l-2+deb9u3 ii libxml2 2.9.4+dfsg1-2.2+deb9u2 ii perl 5.24.1-3+deb9u3 ii zlib1g 1:1.2.8.dfsg-5 Versions of packages apache2-bin suggests: ii apache2-doc 2.4.25-3+deb9u4 pn apache2-suexec-pristine | apache2-suexec-custom <none> ii lynx [www-browser] 2.8.9dev11-1 ii w3m [www-browser] 0.5.3-34+deb9u1 Versions of packages apache2 is related to: ii apache2 2.4.25-3+deb9u4 ii apache2-bin 2.4.25-3+deb9u4 -- Configuration Files: /etc/apache2/apache2.conf changed [not included] /etc/apache2/conf-available/security.conf changed [not included] /etc/apache2/mods-available/ssl.conf changed [not included] /etc/apache2/mods-available/userdir.conf changed [not included] /etc/apache2/ports.conf changed [not included] -- no debconf information
--- End Message ---
--- Begin Message ---Source: apache2 Source-Version: 2.4.25-3+deb9u5 We believe that the bug you reported is fixed in the latest version of apache2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 897...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Stefan Fritsch <s...@debian.org> (supplier of updated apache2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 02 Jun 2018 10:01:13 +0200 Source: apache2 Binary: apache2 apache2-data apache2-bin apache2-utils apache2-suexec-pristine apache2-suexec-custom apache2-doc apache2-dev apache2-ssl-dev apache2-dbg Architecture: source amd64 all Version: 2.4.25-3+deb9u5 Distribution: stretch Urgency: medium Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org> Changed-By: Stefan Fritsch <s...@debian.org> Description: apache2 - Apache HTTP Server apache2-bin - Apache HTTP Server (modules and other binary files) apache2-data - Apache HTTP Server (common files) apache2-dbg - Apache debugging symbols apache2-dev - Apache HTTP Server (development headers) apache2-doc - Apache HTTP Server (on-site documentation) apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers) apache2-suexec-custom - Apache HTTP Server configurable suexec program for mod_suexec apache2-suexec-pristine - Apache HTTP Server standard suexec program for mod_suexec apache2-utils - Apache HTTP Server (utility programs for web servers) Closes: 850947 873945 897218 898563 Changes: apache2 (2.4.25-3+deb9u5) stretch; urgency=medium . * Upgrade mod_http and mod_proxy_http2 to the versions from 2.4.33. This fixes - CVE-2018-1302: mod_http2: Potential crash w/ mod_http2 - Segfaults in mod_http2 (Closes: #873945) - mod_http2 issue with option "Indexes" and directive "HeaderName" (Closes: #850947) Unfortunately, this also removes support for http2 when running on mpm_prefork. * mod_http2: Avoid high memory usage with large files, causing crashes on 32bit archs. Closes: #897218 * Make the apache-htcacheclean init script actually look into /etc/default/apache-htcacheclean for its config. Closes: #898563 Checksums-Sha1: fdac535212c1cf95c335c058966b09341cca546f 2986 apache2_2.4.25-3+deb9u5.dsc 222669e18a9027b65e7d49c5addb58670a627449 786444 apache2_2.4.25-3+deb9u5.debian.tar.xz 42daafa1a07e6af45f9db52c94b318ffc5504bbf 1185526 apache2-bin_2.4.25-3+deb9u5_amd64.deb faf46c716f49448978c8999f3155ec64b6ce8a93 162430 apache2-data_2.4.25-3+deb9u5_all.deb 37fb8923ae00f527086924e9b1eb5b2e1c29635d 4016942 apache2-dbg_2.4.25-3+deb9u5_amd64.deb 33d6b7816874b12fea0dcb09e9563128ac74931c 313898 apache2-dev_2.4.25-3+deb9u5_amd64.deb 24e76f8ba471f18899735f371c9f4dc442ef8876 3770868 apache2-doc_2.4.25-3+deb9u5_all.deb d4b76295607383d06d970252fb6f514cec41cf94 2264 apache2-ssl-dev_2.4.25-3+deb9u5_amd64.deb d745709ad9f29b3fa48cb7a08a8a41015d19abc8 155174 apache2-suexec-custom_2.4.25-3+deb9u5_amd64.deb ec4471ee41e7fa3bd0afcaca8bc7b7a365fcafe0 153704 apache2-suexec-pristine_2.4.25-3+deb9u5_amd64.deb 0568111f1c2eaa209919ae4e94beeac4f3bc4419 217066 apache2-utils_2.4.25-3+deb9u5_amd64.deb a81e796710a4c0974fd6ba013d6d772df666eb09 10102 apache2_2.4.25-3+deb9u5_amd64.buildinfo fe3bd51275b977b519ffcc9a70d84996106dc92d 235980 apache2_2.4.25-3+deb9u5_amd64.deb Checksums-Sha256: 89f87b98db2629bb298e83a27bfc8078a141e6001303b55cc5947e4535aba43b 2986 apache2_2.4.25-3+deb9u5.dsc 66d6f8381e5e913e0e20fa5d555115d55d82dbbd2110c3c44d591840bf57f143 786444 apache2_2.4.25-3+deb9u5.debian.tar.xz 259001920e738bcff8b06dc59c5ed0e2c279de7995b4a7763c0c73b29a7a46ac 1185526 apache2-bin_2.4.25-3+deb9u5_amd64.deb 0407478f446ed7253b7f43c3907ae4bc4c913437c1e0b8b75db2bd35a15480e2 162430 apache2-data_2.4.25-3+deb9u5_all.deb 5ecceac2ffbe5776fc5007fda814f3235a1f68a980bee15dfb961dbcf87d854c 4016942 apache2-dbg_2.4.25-3+deb9u5_amd64.deb 859f190b80bcf14197f1060f3bbba43f403615004b1fc3d840f2fd226337eda5 313898 apache2-dev_2.4.25-3+deb9u5_amd64.deb 6b51d63e7224f88298655723d3fa75a878c030882e89d8b4919ee0e7299cb770 3770868 apache2-doc_2.4.25-3+deb9u5_all.deb e7ef47fb459933c2786f11e414b5f38ec41e385b6daa091e643029e2190fadbd 2264 apache2-ssl-dev_2.4.25-3+deb9u5_amd64.deb 2e9152dbb2449789598774ac29badf45fe54e473978f6ec0226027a87a58f893 155174 apache2-suexec-custom_2.4.25-3+deb9u5_amd64.deb 2f2db56dee710dee5c023d3eae51fc0687fa0b24addb0693f9a0988fffedf8b9 153704 apache2-suexec-pristine_2.4.25-3+deb9u5_amd64.deb 65048e223915b9fe2ad5d6af2ab2cbb06b07f79bb7f3af0abc22b3ad4db73ca5 217066 apache2-utils_2.4.25-3+deb9u5_amd64.deb 10609d5e3c05a7c162e93bb9bd6896f42609252cfb51dfc697c880aa8965f674 10102 apache2_2.4.25-3+deb9u5_amd64.buildinfo 2f0b391e8ad280747fcb4846d2fa48135e2bccd6bb358e3ca5dd50b08713bacc 235980 apache2_2.4.25-3+deb9u5_amd64.deb Files: adca6af370ddcabf704dd20529dcd12c 2986 httpd optional apache2_2.4.25-3+deb9u5.dsc d7a3d205fc0516654e904c6f844d5887 786444 httpd optional apache2_2.4.25-3+deb9u5.debian.tar.xz 06fe2c27af927b1e8d95acbec6d4eabf 1185526 httpd optional apache2-bin_2.4.25-3+deb9u5_amd64.deb a7dc8ef5496a3d9fe736d1b71a0ea8ae 162430 httpd optional apache2-data_2.4.25-3+deb9u5_all.deb f445cd12998b585e500864e38af2cd23 4016942 debug extra apache2-dbg_2.4.25-3+deb9u5_amd64.deb a037c139900c8d9f7d4e7e18104d8449 313898 httpd optional apache2-dev_2.4.25-3+deb9u5_amd64.deb 496e62321bc3635702273f3fc347a772 3770868 doc optional apache2-doc_2.4.25-3+deb9u5_all.deb 805f7c041563282647d7371691c9e1a3 2264 httpd optional apache2-ssl-dev_2.4.25-3+deb9u5_amd64.deb a976442c7c324f09eb87e414a6eef666 155174 httpd extra apache2-suexec-custom_2.4.25-3+deb9u5_amd64.deb ead7c32c002109866da50589aeb6420c 153704 httpd optional apache2-suexec-pristine_2.4.25-3+deb9u5_amd64.deb 230b2c6b1b2bff67c1548819d90abc2a 217066 httpd optional apache2-utils_2.4.25-3+deb9u5_amd64.deb 1472bd7aed256344348f5354b7c0ec60 10102 httpd optional apache2_2.4.25-3+deb9u5_amd64.buildinfo 196a09a927954e927802fa47bcc0bf52 235980 httpd optional apache2_2.4.25-3+deb9u5_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOpiNza8JqByyYYsxxodfNUHO/eAFAlsSVMMACgkQxodfNUHO /eA6ixAArXXpZ7PBw/3hm6OJUTdj4zCbRnq9IQqBd+A5jyuKE0AAByYlaAn5VgBu 8LcRABX/GtoGQ7QGWCaXS8nPtiJv0Tt0DcrttFCVUaqPfLva7tvUluB1Ok1wchXI B4u5VErSNaqrJZCQWqi9O7vKPzeWTpAU1M0I9SsnxVce8B9EH3vRIF2xo0y/KAkS 6f1ae6hhRoD7ScWwpPW2LSGB/UlhzlGLNAY1KyBuEhy56VzI9UWZN/M6lbTb15E2 OP4acrKTqy99leojQU/6qjlkdHzLEgWryF/k5eRa5n5QOQ3l39mfUTFEHJxvZvpb C2SRnc/VuumegTjM//tnIwHbf+IO2vpqt0b0kT/24IMiqMiVqd3XWLQ3NrGA2NTD hSLdz5aUp6ESXFULHisSOAfdFefoFtx4TuNTIWt0txXCw6TVUV8/+Xe7H9EVR/C/ edKXZ8xSx/8m4LN5uENamEjc34Z3bKIfB9yp69MKtCElHQBW8ezDOwYLpoXSuHHw dyLfXRK6918twisffzqjeu4XiEgBrAE3v7Kz1s1xnqhH4DeEa0GGNATsft0N8p7n UgOPVfls//TI9qR79IJKx1rSU6h23CBd9AIh38kroY0JXayBj8nqKJLyEamLS8+b LlTK1ZOqs7xqaxGxVXx2auLxDLoi9dNsDhsTCzMSWU9D/h/xVLw= =Tggv -----END PGP SIGNATURE-----
--- End Message ---
