From 89633d0b11d6974933fb1b0ec267506218451360 Mon Sep 17 00:00:00 2001 From: Paul Menzel Date: Thu, 22 Oct 2026 16:47:23 +0200 Subject: [PATCH] apr-util: Update version from 1.6.1 to 1.6.5 The installed apr-util, built in 2021, still links its LDAP module against OpenLDAP 2.4 and OpenSSL 1.1, now only provided by openldap-libonly_compat and openssl1: $ ldd /usr/lib/apr-util-1/apr_ldap-1.so | grep -E 'ldap|lber|ssl|crypto' libldap-2.4.so.2 => /lib/libldap-2.4.so.2 (0x00007fad36400000) liblber-2.4.so.2 => /lib/liblber-2.4.so.2 (0x00007fad36000000) libssl.so.1.1 => /lib/libssl.so.1.1 (0x00007fad3673c000) libcrypto.so.1.1 => /lib/libcrypto.so.1.1 (0x00007fad35800000) Rebuild it against OpenLDAP 2.6.10 and OpenSSL 3.6.2, and update to the latest upstream release while at it, which fixes CVE-2025-49506, CVE-2026-32327, CVE-2026-34191, CVE-2026-34501 and CVE-2026-34502. configure searches for `-lldap` and never for `-lldap_r`, so the `/usr/lib/libldap_r.so` symlink from openldap-libonly_compat, still pointing to 2.4, is not picked up. libaprutil-1.so.0 keeps its soname. Assisted-by: claude-opus-5.5 (Claude Code) --- apr-util.be0 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apr-util.be0 b/apr-util.be0 index 890f37da6..f497d3dc7 100755 --- a/apr-util.be0 +++ b/apr-util.be0 @@ -1,11 +1,11 @@ #!/usr/bin/env beesh -# BEE_VERSION apr-util-1.6.1-1 +# BEE_VERSION apr-util-1.6.5-0 BEE_BUILDTYPE=autotools # SRCURL[0]="https://ftp.fau.de/apache/apr/apr-util-${PKGVERSION}.tar.gz" -SRCURL[0]="https://beehive.molgen.mpg.de/bd502b9a8670a8012c4d90c31a84955f/apr-util-1.6.1.tar.gz" +SRCURL[0]="https://beehive.molgen.mpg.de/223ec230d1955d3c65dba68836a0bd97/apr-util-1.6.5.tar.gz" # PATCHURL+=()