You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2004/05/11 14:32:22 UTC
cvs commit: httpd-dist .htaccess Announcement.html Announcement.html.de Announcement.txt
jim 2004/05/11 05:32:22
Modified: . .htaccess Announcement.html Announcement.html.de
Announcement.txt
Log:
Start 1.3.31 release process... still need HTML for non-english announcements
Revision Changes Path
1.98 +4 -4 httpd-dist/.htaccess
Index: .htaccess
===================================================================
RCS file: /home/cvs/httpd-dist/.htaccess,v
retrieving revision 1.97
retrieving revision 1.98
diff -u -r1.97 -r1.98
--- .htaccess 9 Apr 2004 01:15:57 -0000 1.97
+++ .htaccess 11 May 2004 12:32:21 -0000 1.98
@@ -20,11 +20,11 @@
AddDescription "Source code patch" *.patch
AddDescription "Apache 2.0 Release Note" Announcement2
AddDescription "Apache 1.3 Release Note" Announcement
-AddDescription "Current Release 1.3.29" apache_1.3.29 apache_1.3.29_
+AddDescription "Current Release 1.3.31" apache_1.3.31 apache_1.3.31_
AddDescription "Patch to fix mod_rewrite" apache_1.3.*-fix.diff
-AddDescription "1.3.29 compressed source" apache_1.3.29.tar.Z
-AddDescription "1.3.29 gzipped source" apache_1.3.29.tar.gz
-AddDescription "1.3.29 pkzipped source" apache_1.3.29.zip
+AddDescription "1.3.31 compressed source" apache_1.3.31.tar.Z
+AddDescription "1.3.31 gzipped source" apache_1.3.31.tar.gz
+AddDescription "1.3.31 pkzipped source" apache_1.3.31.zip
AddDescription "2.0.48 compressed source" httpd-2.0.48.tar.Z
AddDescription "2.0.48 gzipped source" httpd-2.0.48.tar.gz
AddDescription "2.0.49 compressed source" httpd-2.0.49.tar.Z
1.19 +93 -41 httpd-dist/Announcement.html
Index: Announcement.html
===================================================================
RCS file: /home/cvs/httpd-dist/Announcement.html,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- Announcement.html 28 Oct 2003 13:29:38 -0000 1.18
+++ Announcement.html 11 May 2004 12:32:21 -0000 1.19
@@ -15,34 +15,58 @@
<IMG SRC="../../images/apache_sub.gif" ALT="">
-<h1>Apache HTTP Server 1.3.29 Released</h1>
+<h1>Apache HTTP Server 1.3.31 Released</h1>
<p> The Apache Software Foundation and The Apache HTTP Server Project are
- pleased to announce the release of version 1.3.29 of the Apache HTTP
+ pleased to announce the release of version 1.3.31 of the Apache HTTP
Server ("Apache"). This Announcement notes the significant changes
- in 1.3.29 as compared to 1.3.28. The Announcement is also available
- in German from <a href="http://www.apache.org/dist/httpd/Announcement.html.de"
- >http://www.apache.org/dist/httpd/Announcement.html.de</a>.</p>
+ in 1.3.31 as compared to 1.3.29 (1.3.30 was not released).
+<!--
+ The Announcement is also available in German, Spanish and Japanese from:
+
+ <a href="http://www.apache.org/dist/httpd/Announcement.html.de">http://www.apache.org/dist/httpd/Announcement.html.de</a>
+ <a href="http://www.apache.org/dist/httpd/Announcement.html.es">http://www.apache.org/dist/httpd/Announcement.html.es</a>
+ <a href="http://www.apache.org/dist/httpd/Announcement.html.ja">http://www.apache.org/dist/httpd/Announcement.html.ja</a>
+-->
+ </p>
<p>This version of Apache is principally a bug and security fix release.
A partial summary of the bug fixes is given at the end of this document.
A full listing of changes can be found in the CHANGES file. Of
- particular note is that 1.3.29 addresses and fixes 1 potential
+ particular note is that 1.3.31 addresses and fixes 4 potential
security issue:</p>
<ul>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542"
- >CAN-2003-0542 (cve.mitre.org)</a>: Fix buffer overflows in mod_alias and
- mod_rewrite which occurred if one configured a regular expression with more
- than 9 captures.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">
+ o CAN-2003-0987 (cve.mitre.org)</a><br>
+ In <code>mod_digest</code>, verify whether the nonce returned in the client
+ response is one we issued ourselves. This problem does not affect
+ <code>mod_auth_digest</code>.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">
+ CAN-2003-0020 (cve.mitre.org)</a><br>
+ Escape arbitrary data before writing into the errorlog.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174">
+ CAN-2004-0174 (cve.mitre.org)</a><br>
+ Fix starvation issue on listening sockets where a short-lived
+ connection on a rarely-accessed listening socket will cause a
+ child to hold the accept mutex and block out new connections until
+ another connection arrives on that rarely-accessed listening socket.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993">
+ CAN-2003-0993 (cve.mitre.org)</a><br>
+ Fix parsing of Allow/Deny rules using IP addresses without a
+ netmask; issue is only known to affect big-endian 64-bit
+ platforms</li>
</ul>
-<p>We consider Apache 1.3.29 to be the best version of Apache 1.3 available
+<p>We consider Apache 1.3.31 to be the best version of Apache 1.3 available
and we strongly recommend that users of older versions, especially of
the 1.1.x and 1.2.x family, upgrade as soon as possible. No further
releases will be made in the 1.2.x family.</p>
-<p>Apache 1.3.29 is available for download from</p>
+<p>Apache 1.3.31 is available for download from</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi">http://httpd.apache.org/download.cgi</a></dd>
</dl>
@@ -100,52 +124,80 @@
of the servers on the Internet are running Apache or one of its
variants.</p>
-<h2>Apache 1.3.29 Major changes</h2>
+<h2>Apache 1.3.31 Major changes</h2>
<h3>Security vulnerabilities</h3>
<p>
- The main security vulnerabilities addressed in 1.3.29 are:
+ The main security vulnerabilities addressed in 1.3.31 are:
</p>
<ul>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-CAN-2003-0542"
- >CAN-2003-0542 (cve.mitre.org)</a>: Fix buffer overflows in mod_alias and
- mod_rewrite which occurred if one configured a regular expression with more
- than 9 captures.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">
+ o CAN-2003-0987 (cve.mitre.org)</a><br>
+ In <code>mod_digest</code>, verify whether the nonce returned in the client
+ response is one we issued ourselves. This problem does not affect
+ <code>mod_auth_digest</code>.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">
+ CAN-2003-0020 (cve.mitre.org)</a><br>
+ Escape arbitrary data before writing into the errorlog.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174">
+ CAN-2004-0174 (cve.mitre.org)</a><br>
+ Fix starvation issue on listening sockets where a short-lived
+ connection on a rarely-accessed listening socket will cause a
+ child to hold the accept mutex and block out new connections until
+ another connection arrives on that rarely-accessed listening socket.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993">
+ CAN-2003-0993 (cve.mitre.org)</a><br>
+ Fix parsing of Allow/Deny rules using IP addresses without a
+ netmask; issue is only known to affect big-endian 64-bit
+ platforms</li>
</ul>
-
<h3>New features</h3>
<p>
New features that relate to specific platforms:
</p>
<ul>
- <li>Enabled RFC1413 ident functionality for both Win32 and
- NetWare platforms. This also included an alternate thread safe
- implementation of the socket timout functionality when querying
- the identd daemon.</li>
+ <li>Linux 2.4+: If Apache is started as root and you code<code>CoreDumpDirectory</code>,
+ coredumps are enabled via the <code>prctl()</code> syscall.</li>
+</ul>
+<p>
+ New features that relate to specific platforms:
+</p>
+<ul>
+ <li>Add <code>mod_whatkilledus</code> and <code>mod_backtrace</code> (experimental) for
+ reporting diagnostic information after a child process crash.</li>
+
+ <li>Add fatal exception hook for running diagnostic code after a
+ crash. </li>
+
+ <li>Forensic logging module added (<code>mod_log_forensic</code>)</li>
+
+ <li><code>'%X'</code> is now accepted as an alias for <code>'%c'</code> in the
+ <code>LogFormat</code> directive. This allows you to configure logging
+ to still log the connection status even with <code>mod_ssl</code></li>
</ul>
<p>
<h3>Bugs fixed</h3>
<p>
- The following bugs were found in Apache 1.3.28 (or earlier) and have been fixed in
- Apache 1.3.29:
+ The following bugs were found in Apache 1.3.29 (or earlier) and have been fixed in
+ Apache 1.3.31:
</p>
<ul>
- <li>Within <code>ap_bclose()</code>, <code>ap_pclosesocket()</code> is now called consistently
- for sockets and <code>ap_pclosef()</code> for files. Also, <code>closesocket()</code>
- is used consistenly to close socket fd's. The previous
- confusion between socket and file fd's would cause problems
- with some applications now that we proactively close fd's to
- prevent leakage.
- <a href="http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22805">PR 22805.</a></li>
-
- <li>Fixed mod_usertrack to not get false positive matches on the
- user-tracking cookie's name.
- <a href="http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16661">PR 16661.</a></li>
-
- <li>Prevent creation of subprocess Zombies when using CGI wrappers
- such as suEXEC and cgiwrap.
- <a href="http://nagoya.apache.org/bugzilla/show_bug.cgi?id=21737">PR 21737.</a></li>
-
+ <li>Fix memory corruption problem with <code>ap_custom_response()</code> function.
+ The core per-dir config would later point to request pool data
+ that would be reused for different purposes on different requests.</li>
+
+ <li><code>mod_usertrack</code> no longer inspects the <code>Cookie2</code> header for
+ the cookie name. It also no longer overwrites other cookies.</li>
+
+ <li>Fix bug causing core dump when using <code>CookieTracking</code> without
+ specifying a <code>CookieName</code> directly.</li>
+
+ <li><code>UseCanonicalName off</code> was ignoring the client provided
+ port information.</li>
+</li>
</ul>
</BODY>
1.3 +83 -40 httpd-dist/Announcement.html.de
Index: Announcement.html.de
===================================================================
RCS file: /home/cvs/httpd-dist/Announcement.html.de,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- Announcement.html.de 28 Oct 2003 11:24:40 -0000 1.2
+++ Announcement.html.de 11 May 2004 12:32:21 -0000 1.3
@@ -15,12 +15,12 @@
<IMG SRC="../../images/apache_sub.gif" ALT="">
-<h1>Apache HTTP Server 1.3.29 freigegeben</h1>
+<h1>Apache HTTP Server 1.3.30 freigegeben</h1>
<p>Wir, die Apache Software Foundation und das Apache HTTP Server Projekt,
- freuen uns, die Freigabe der Version 1.3.29 des Apache HTTP Servers
+ freuen uns, die Freigabe der Version 1.3.30 des Apache HTTP Servers
("Apache") bekannt zu geben. Diese Ankündigung führt die
- wesentlichen Änderungen von 1.3.29 gegenüber 1.3.28 auf. Die
+ wesentlichen Änderungen von 1.3.30 gegenüber 1.3.9 auf. Die
Ankündigung ist auch in englischer Sprache unter <a
href="http://www.apache.org/dist/httpd/Announcement.html"
>http://www.apache.org/dist/httpd/Announcement.html</a> verfügbar.</p>
@@ -28,23 +28,36 @@
<p>Diese Version des Apache ist vornehmlich ein Bug-Fix- und Sicherheits-
Update. Eine kurze Zusammenfassung der Bug-Fixes ist am Ende des Dokumentes
aufgeführt. Die vollständige Liste der Änderungen ist in der
- CHANGES-Datei zu finden. Apache 1.3.29 behebt insbesondere 1
- Sicherheitslücke.</p>
+ CHANGES-Datei zu finden. Apache 1.3.30 behebt insbesondere 3 mögliche
+ Sicherheitslücken.</p>
<ul>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542"
- >CAN-2003-0542 (cve.mitre.org)</a>: Behebung von Pufferüberläufen
- in mod_alias und mod_rewrite, welche auftraten, falls reguläre
- Ausdrücke mit mehr als 9 speichernden Klammernpaaren angewendet
- wurden.</li>
-</ul>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020"
+ >CAN-2003-0020 (cve.mitre.org)</a>:
+ Daten beliebiger Herkunft werden maskiert, bevor sie ins
+ Fehlerprotokoll geschrieben werden.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174"
+ >CAN-2004-0174 (cve.mitre.org)</a>:
+ Korrektur von "verhungernden" lauschenden Sockets, wo eine
+ kurzlebige Verbindung an einem selten verbundenen, lauschenden Socket
+ einen Kindprozess veranlaßt, den Accept-Mutex festzuhalten und
+ neue Verbindungen solange zu blockieren, bis eine weitere Verbindung
+ auf dem selten verbundenen Socket eintrifft.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993"
+ >CAN-2003-0993 (cve.mitre.org)</a>:
+ Korrektur des Parsers für Allow-/Deny-Regeln, die IP-Adressen ohne
+ Angabe einer Netmask verwenden. Das Problem ist lediglich auf
+ Big-Endian-64-bit-Plattformen bekannt.</li>
+</ul>
-<p>Wir betrachten den Apache 1.3.29 als die beste verfügbare Version des
+<p>Wir betrachten den Apache 1.3.30 als die beste verfügbare Version des
Apache 1.3 und wir empfehlen Benutzern älterer Versionen, insbesondere
der Familien 1.1.x und 1.2.x, umgehend die Aufrüstung. Für die
1.2.x-Familie werden keine weiteren Releases mehr erstellt.</p>
-<p>Apache 1.3.29 steht unter folgender Adresse zum Download bereit:</p>
+<p>Apache 1.3.30 steht unter folgender Adresse zum Download bereit:</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi"
>http://httpd.apache.org/download.cgi</a></dd>
@@ -105,7 +118,7 @@
Universums. Mehr als die Hälfte aller Server im Internet laufen mit dem
Apache oder einem seiner Derivate.</p>
-<h2>Wesentliche Änderungen des Apache 1.3.29</h2>
+<h2>Wesentliche Änderungen des Apache 1.3.30</h2>
<h3>Sicherheitslücken</h3>
<p>
@@ -113,44 +126,74 @@
wurden, sind:
</p>
<ul>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-542"
- >CAN-2003-0542 (cve.mitre.org)</a>: Behebung von
- Pufferüberläufen in mod_alias und mod_rewrite, welche auftraten,
- falls reguläre Ausdr�cke mit mehr als 9 speichernden Klammernpaaren
- angewendet wurden.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020"
+ >CAN-2003-0020 (cve.mitre.org)</a>:
+ Daten beliebiger Herkunft werden maskiert, bevor sie ins
+ Fehlerprotokoll geschrieben werden.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174"
+ >CAN-2004-0174 (cve.mitre.org)</a>:
+ Korrektur von "verhungernden" lauschenden Sockets, wo eine
+ kurzlebige Verbindung an einem selten verbundenen, lauschenden Socket
+ einen Kindprozess veranlaßt, den Accept-Mutex festzuhalten und
+ neue Verbindungen solange zu blockieren, bis eine weitere Verbindung
+ auf dem selten verbundenen Socket eintrifft.</li>
+
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993"
+ >CAN-2003-0993 (cve.mitre.org)</a>:
+ Korrektur des Parsers für Allow-/Deny-Regeln, die IP-Adressen ohne
+ Angabe einer Netmask verwenden. Das Problem ist lediglich auf
+ Big-Endian-64-bit-Plattformen bekannt.</li>
</ul>
-<h3>Neue Features</h3>
+<h3>Neuerungen</h3>
<p>Neue Features, die sich auf bestimmte Plattformen beziehen:</p>
<ul>
- <li>Die ident-Funktionalität gemäß RFC1413 ist nun sowohl
- für Windows- wie auch f�r NetWare-Plattformen verfügbar. Dies
- beinhaltet auch eine alternative Thread-sichere Implementation der
- Socket-Timeout-Funktionalität bei der Abfrage des identd-Daemons.</li>
+ <li>Linux 2.4+: Wenn der Apache als root startet und CoreDumpDirectory
+ gesetzt ist, sind Speicherauszüge mittels des Systemaufrufes
+ <code>prctl()</code> aktiviert.</li>
+</ul>
+<p>
+<h3>Neue Funktionen f�r alle Plattformen:</h3>
+<ul>
+ <li>neue Zusatzmodule: mod_whatkilledus und mod_backtrace (experimentell)
+ zur Auswertung von Diagnosedaten nach dem Absturz eines Kindprozesses.
+ </li>
+
+ <li>Hinzufügen eines Hooks f�r schwere Ausnahmefehler zur Verwendung
+ von Diagnosemodulen nach einem Absturz.</li>
+
+ <li>Neues Modul zur forensischen Protokollierung (mod_log_forensic)</li>
+
+ <li><code>%X</code> wird von der Direktive LogFormat jetzt als Alias
+ für <code>%c</code> akzeptiert. Das ermöglicht nun auch
+ mit mod_ssl die Protokollierung des Verbindungsstatus.</li>
</ul>
<p>
<h3>Behobene Fehler</h3>
<p>
- Die folgenden nennenswerten Fehler wurden im Apache 1.3.28 (oder
- früher) gefunden und im Apache 1.3.29 behoben:
+ Die folgenden nennenswerten Fehler wurden im Apache 1.3.29 (oder
+ früher) gefunden und im Apache 1.3.30 behoben:
</p>
<ul>
- <li>Innerhalb von ap_bclose() wird nun durchweg ap_pclosesocket() für
- Sockets und sp_pclosef() für Dateien aufgerufen. Ebenso wird nun
- einheitlich closesocket() zum Schließen der (Dateideskriptoren von)
- Sockets verwendet. Das vorherige Durcheinander von Dateideskriptoren
- für Sockets und Dateien würde bei einigen Applikationen Probleme
- verursachen, jetzt wo wir vorsorglich Dateideskriptoren schließen,
- um Lecks zu vermeiden. PR 22805.</li>
-
- <li>Korrektur von mod_usertrack, um keine fälschlich zutreffenden
- Übereinstimmungen mit dem Namen des user-tracking-Cookies zu
- erhalten. PR 16661.</li>
-
- <li>Die Bildung von Subprozess-Zombies bei der Verwendung von CGI-Wrappern
- wie suEXEC und cgiwrap wird verhindert. PR 21737.</li>
+ <li>Korrektur von Speicherkorruptionen bei der Funktion
+ <code>ap_custom_response()</code>. Die per-dir-Grunkonfiguration
+ würde später auf Daten des Request-Pools zeigen, die für
+ verschiedene Zwecke bei verschiedenen Anfragen wieder benutzt
+ würden.</li>
+
+ <li>mod_usertrack überprüft nicht länger den
+ Cookie2-Header auf den Cookienamen. Es überschreibt auch keine
+ anderen Cookies mehr.</li>
+
+ <li>Korrektur eines Fehlers, der einen Speicherauszug verursachte, wenn
+ CookieTracking ohne direkte Angabe eines Cookienamens verwendet
+ wurde.</li>
+
+ <li><code>UseCanonicalName off</code> hatte den vom Client
+ übermittelten Port ignoriert.</li>
</ul>
</BODY>
1.17 +80 -32 httpd-dist/Announcement.txt
Index: Announcement.txt
===================================================================
RCS file: /home/cvs/httpd-dist/Announcement.txt,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- Announcement.txt 28 Oct 2003 13:29:38 -0000 1.16
+++ Announcement.txt 11 May 2004 12:32:21 -0000 1.17
@@ -1,28 +1,49 @@
- Apache HTTP Server 1.3.29 Released
+ Apache HTTP Server 1.3.31 Released
The Apache Software Foundation and The Apache HTTP Server Project are
- pleased to announce the release of version 1.3.29 of the Apache HTTP
+ pleased to announce the release of version 1.3.31 of the Apache HTTP
Server ("Apache"). This Announcement notes the significant changes
- in 1.3.29 as compared to 1.3.28. The Announcement is also available
- in German from http://www.apache.org/dist/httpd/Announcement.html.de.
+ in 1.3.31 as compared to 1.3.29 (1.3.30 was not released). The
+ Announcement is also available in German, Spanish and Japanese from:
+
+ http://www.apache.org/dist/httpd/Announcement.html.de
+ http://www.apache.org/dist/httpd/Announcement.html.es
+ http://www.apache.org/dist/httpd/Announcement.html.ja
This version of Apache is principally a bug and security fix release.
A partial summary of the bug fixes is given at the end of this document.
A full listing of changes can be found in the CHANGES file. Of
- particular note is that 1.3.29 addresses and fixes 1 potential
- security issue:
+ particular note is that 1.3.31 addresses and fixes 4 potential
+ security issues:
- o CAN-2003-0542 (cve.mitre.org)
- Fix buffer overflows in mod_alias and mod_rewrite which occurred if
- one configured a regular expression with more than 9 captures.
+ o CAN-2003-0987 (cve.mitre.org)
+ In mod_digest, verify whether the nonce returned in the client
+ response is one we issued ourselves. This problem does not affect
+ mod_auth_digest.
+
+ o CAN-2003-0020 (cve.mitre.org)
+ Escape arbitrary data before writing into the errorlog.
+
+ o CAN-2004-0174 (cve.mitre.org)
+ Fix starvation issue on listening sockets where a short-lived
+ connection on a rarely-accessed listening socket will cause a
+ child to hold the accept mutex and block out new connections until
+ another connection arrives on that rarely-accessed listening socket.
+ This only affects some platforms, such as Solaris, AIX and
+ IRIX. Linux is unaffected.
+
+ o CAN-2003-0993 (cve.mitre.org)
+ Fix parsing of Allow/Deny rules using IP addresses without a
+ netmask; issue is only known to affect big-endian 64-bit
+ platforms
- We consider Apache 1.3.29 to be the best version of Apache 1.3 available
+ We consider Apache 1.3.31 to be the best version of Apache 1.3 available
and we strongly recommend that users of older versions, especially of
the 1.1.x and 1.2.x family, upgrade as soon as possible. No further
releases will be made in the 1.2.x family.
- Apache 1.3.29 is available for download from:
+ Apache 1.3.31 is available for download from:
http://httpd.apache.org/download.cgi
@@ -71,38 +92,65 @@
Apache 2.0 for better performance, stability and security on their
platforms.
- Apache 1.3.29 Major changes
+ Apache 1.3.31 Major changes
Security vulnerabilities
- * CAN-2003-0542 (cve.mitre.org)
- Fix buffer overflows in mod_alias and mod_rewrite which occurred if
- one configured a regular expression with more than 9 captures.
+ * CAN-2003-0987 (cve.mitre.org)
+ In mod_digest, verify whether the nonce returned in the client
+ response is one we issued ourselves. This problem does not affect
+ mod_auth_digest.
+
+ * CAN-2003-0020 (cve.mitre.org)
+ Escape arbitrary data before writing into the errorlog.
+
+ * CAN-2004-0174 (cve.mitre.org)
+ Fix starvation issue on listening sockets where a short-lived
+ connection on a rarely-accessed listening socket will cause a
+ child to hold the accept mutex and block out new connections until
+ another connection arrives on that rarely-accessed listening socket.
+
+ * CAN-2003-0993 (cve.mitre.org)
+ Fix parsing of Allow/Deny rules using IP addresses without a
+ netmask; issue is only known to affect big-endian 64-bit
+ platforms
New features
New features that relate to specific platforms:
- * Enabled RFC1413 ident functionality for both Win32 and
- NetWare platforms. This also included an alternate thread safe
- implementation of the socket timout functionality when querying
- the identd daemon.
+ * Linux 2.4+: If Apache is started as root and you code
+ CoreDumpDirectory, core dumps are enabled via the prctl() syscall.
+
+ New features that relate to all platforms:
+
+ * Add mod_whatkilledus and mod_backtrace (experimental) for
+ reporting diagnostic information after a child process crash.
+
+ * Add fatal exception hook for running diagnostic code after a
+ crash.
+
+ * Forensic logging module added (mod_log_forensic)
+
+ * '%X' is now accepted as an alias for '%c' in the
+ LogFormat directive. This allows you to configure logging
+ to still log the connection status even with mod_ssl
Bugs fixed
- The following noteworthy bugs were found in Apache 1.3.28 (or earlier)
- and have been fixed in Apache 1.3.29:
+ The following noteworthy bugs were found in Apache 1.3.29 (or earlier)
+ and have been fixed in Apache 1.3.31:
+
+ * Fix memory corruption problem with ap_custom_response() function.
+ The core per-dir config would later point to request pool data
+ that would be reused for different purposes on different requests.
+
+ * mod_usertrack no longer inspects the Cookie2 header for
+ the cookie name. It also no longer overwrites other cookies.
- * Within ap_bclose(), ap_pclosesocket() is now called consistently
- for sockets and ap_pclosef() for files. Also, closesocket()
- is used consistenly to close socket fd's. The previous
- confusion between socket and file fd's would cause problems
- with some applications now that we proactively close fd's to
- prevent leakage. PR 22805.
-
- * Fixed mod_usertrack to not get false positive matches on the
- user-tracking cookie's name. PR 16661.
+ * Fix bug causing core dump when using CookieTracking without
+ specifying a CookieName directly.
- * Prevent creation of subprocess Zombies when using CGI wrappers
- such as suEXEC and cgiwrap. PR 21737.
+ * UseCanonicalName off was ignoring the client provided
+ port information.