Bug#1076531: bookworm-pu: package apache2/2.4.62-1~deb12u1

["Adam D. Barratt" <adam@adam-barratt.org.uk>]

Control: tags -1 + confirmed

On Thu, 2024-07-18 at 09:39 +0400, Yadd wrote:
> [ Reason ]
> Apache2 was updated to 2.4.61 due to 8 CVEs. However "a partial fix
> for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores
> some use of the legacy content-type based configuration of handlers.
> "AddType" and similar configuration, under some circumstances where
> files are requested indirectly, result in source code disclosure of
> local content. For example, PHP scripts may
> be served instead of interpreted".
> 
> It's difficult to find in upstream commits what are "under some
> circumstances" neither in upstream explanations.

Please go ahead.

Regards,

Adam