You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by wr...@apache.org on 2014/08/22 14:19:12 UTC
svn commit: r6245 - in /dev/httpd: CHANGES_2.2 CHANGES_2.2.28
httpd-2.2.28.tar.bz2 httpd-2.2.28.tar.bz2.asc httpd-2.2.28.tar.bz2.md5
httpd-2.2.28.tar.bz2.sha1 httpd-2.2.28.tar.gz httpd-2.2.28.tar.gz.asc
httpd-2.2.28.tar.gz.md5 httpd-2.2.28.tar.gz.sha1
Author: wrowe
Date: Fri Aug 22 12:19:12 2014
New Revision: 6245
Log:
Add 2.2.28 candidate for review and vote
Added:
dev/httpd/CHANGES_2.2.28
dev/httpd/httpd-2.2.28.tar.bz2 (with props)
dev/httpd/httpd-2.2.28.tar.bz2.asc
dev/httpd/httpd-2.2.28.tar.bz2.md5
dev/httpd/httpd-2.2.28.tar.bz2.sha1
dev/httpd/httpd-2.2.28.tar.gz (with props)
dev/httpd/httpd-2.2.28.tar.gz.asc
dev/httpd/httpd-2.2.28.tar.gz.md5
dev/httpd/httpd-2.2.28.tar.gz.sha1
Modified:
dev/httpd/CHANGES_2.2
Modified: dev/httpd/CHANGES_2.2
==============================================================================
--- dev/httpd/CHANGES_2.2 (original)
+++ dev/httpd/CHANGES_2.2 Fri Aug 22 12:19:12 2014
@@ -1,4 +1,75 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.2.28
+
+ *) SECURITY: CVE-2014-0118 (cve.mitre.org)
+ mod_deflate: The DEFLATE input filter (inflates request bodies) now
+ limits the length and compression ratio of inflated request bodies to avoid
+ denial of service via highly compressed bodies. See directives
+ DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
+ and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener]
+
+ *) SECURITY: CVE-2014-0231 (cve.mitre.org)
+ mod_cgid: Fix a denial of service against CGI scripts that do
+ not consume stdin that could lead to lingering HTTPD child processes
+ filling up the scoreboard and eventually hanging the server. By
+ default, the client I/O timeout (Timeout directive) now applies to
+ communication with scripts. The CGIDScriptTimeout directive can be
+ used to set a different timeout for communication with scripts.
+ [Rainer Jung, Eric Covener, Yann Ylavic]
+
+ *) SECURITY: CVE-2014-0226 (cve.mitre.org)
+ Fix a race condition in scoreboard handling, which could lead to
+ a heap buffer overflow. [Joe Orton, Eric Covener, Jeff Trawick]
+
+ *) SECURITY: CVE-2013-5704 (cve.mitre.org)
+ core: HTTP trailers could be used to replace HTTP headers
+ late during request processing, potentially undoing or
+ otherwise confusing modules that examined or modified
+ request headers earlier. Adds "MergeTrailers" directive to restore
+ legacy behavior. [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener]
+
+ *) core: Detect incomplete request and response bodies, log an error and
+ forward it to the underlying filters. PR 55475. [Yann Ylavic]
+
+ *) mod_deflate: Handle Zlib header and validation bytes received in multiple
+ chunks. PR 46146. [Yann Ylavic]
+
+ *) mod_proxy: Don't reuse a SSL backend connection whose requested SNI
+ differs. PR 55782. [Yann Ylavic]
+
+ *) mod_deflate: Fix inflation of files larger than 4GB. PR 56062.
+ [Lukas Bezdicka <social v3.sk>]
+
+ *) mod_dav: Fix improper encoding in PROPFIND responses. PR 56480.
+ [Ben Reser]
+
+ *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions
+ resumed by TLS session resumption (RFC 5077). [Rainer Jung]
+
+ *) mod_proxy_ajp: Forward local IP address as a custom request attribute
+ like we already do for the remote port. [Rainer Jung]
+
+ *) mod_deflate: Don't fail when flushing inflated data to the user-agent
+ and that coincides with the end of stream ("Zlib error flushing inflate
+ buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>]
+
+ *) mod_cache, mod_disk_cache: With CacheLock enabled, responses with a Vary
+ header might not get the benefit of the thundering herd protection due to
+ an incorrect internal cache key. PR 50317.
+ [Ruediger Pluem, Jan Kaluza, Yann Ylavic]
+
+ *) mod_rewrite: Support session cookies with the CO= flag when later
+ parameters are used. The doc for this implied the feature had been
+ backported for quite some time. PR56014 [Eric Covener]
+
+ *) mod_cache: Don't remove stale cache entries that cannot be conditionally
+ revalidated. This prevents the thundering herd protection from serving
+ stale responses during a revalidation. PR 50317.
+ [Eric Covener, Jan Kaluza, Ruediger Pluem]
+
+ *) core: Increase TCP_DEFER_ACCEPT socket option to from 1 to 30 seconds.
+ PR 41270. [Dean Gaudet <dean arctic org>]
+
Changes with Apache 2.2.27
*) SECURITY: CVE-2014-0098 (cve.mitre.org)
@@ -572,7 +643,6 @@ Changes with Apache 2.2.16
*) mod_rewrite: Allow to set environment variables without explicitly
giving a value. [Rainer Jung]
-
Changes with Apache 2.2.15
*) SECURITY: CVE-2009-3555 (cve.mitre.org)
Added: dev/httpd/CHANGES_2.2.28
==============================================================================
--- dev/httpd/CHANGES_2.2.28 (added)
+++ dev/httpd/CHANGES_2.2.28 Fri Aug 22 12:19:12 2014
@@ -0,0 +1,72 @@
+ -*- coding: utf-8 -*-
+Changes with Apache 2.2.28
+
+ *) SECURITY: CVE-2014-0118 (cve.mitre.org)
+ mod_deflate: The DEFLATE input filter (inflates request bodies) now
+ limits the length and compression ratio of inflated request bodies to avoid
+ denial of service via highly compressed bodies. See directives
+ DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
+ and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener]
+
+ *) SECURITY: CVE-2014-0231 (cve.mitre.org)
+ mod_cgid: Fix a denial of service against CGI scripts that do
+ not consume stdin that could lead to lingering HTTPD child processes
+ filling up the scoreboard and eventually hanging the server. By
+ default, the client I/O timeout (Timeout directive) now applies to
+ communication with scripts. The CGIDScriptTimeout directive can be
+ used to set a different timeout for communication with scripts.
+ [Rainer Jung, Eric Covener, Yann Ylavic]
+
+ *) SECURITY: CVE-2014-0226 (cve.mitre.org)
+ Fix a race condition in scoreboard handling, which could lead to
+ a heap buffer overflow. [Joe Orton, Eric Covener, Jeff Trawick]
+
+ *) SECURITY: CVE-2013-5704 (cve.mitre.org)
+ core: HTTP trailers could be used to replace HTTP headers
+ late during request processing, potentially undoing or
+ otherwise confusing modules that examined or modified
+ request headers earlier. Adds "MergeTrailers" directive to restore
+ legacy behavior. [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener]
+
+ *) core: Detect incomplete request and response bodies, log an error and
+ forward it to the underlying filters. PR 55475. [Yann Ylavic]
+
+ *) mod_deflate: Handle Zlib header and validation bytes received in multiple
+ chunks. PR 46146. [Yann Ylavic]
+
+ *) mod_proxy: Don't reuse a SSL backend connection whose requested SNI
+ differs. PR 55782. [Yann Ylavic]
+
+ *) mod_deflate: Fix inflation of files larger than 4GB. PR 56062.
+ [Lukas Bezdicka <social v3.sk>]
+
+ *) mod_dav: Fix improper encoding in PROPFIND responses. PR 56480.
+ [Ben Reser]
+
+ *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions
+ resumed by TLS session resumption (RFC 5077). [Rainer Jung]
+
+ *) mod_proxy_ajp: Forward local IP address as a custom request attribute
+ like we already do for the remote port. [Rainer Jung]
+
+ *) mod_deflate: Don't fail when flushing inflated data to the user-agent
+ and that coincides with the end of stream ("Zlib error flushing inflate
+ buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>]
+
+ *) mod_cache, mod_disk_cache: With CacheLock enabled, responses with a Vary
+ header might not get the benefit of the thundering herd protection due to
+ an incorrect internal cache key. PR 50317.
+ [Ruediger Pluem, Jan Kaluza, Yann Ylavic]
+
+ *) mod_rewrite: Support session cookies with the CO= flag when later
+ parameters are used. The doc for this implied the feature had been
+ backported for quite some time. PR56014 [Eric Covener]
+
+ *) mod_cache: Don't remove stale cache entries that cannot be conditionally
+ revalidated. This prevents the thundering herd protection from serving
+ stale responses during a revalidation. PR 50317.
+ [Eric Covener, Jan Kaluza, Ruediger Pluem]
+
+ *) core: Increase TCP_DEFER_ACCEPT socket option to from 1 to 30 seconds.
+ PR 41270. [Dean Gaudet <dean arctic org>]
+
Added: dev/httpd/httpd-2.2.28.tar.bz2
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.2.28.tar.bz2
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.2.28.tar.bz2.asc
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.bz2.asc (added)
+++ dev/httpd/httpd-2.2.28.tar.bz2.asc Fri Aug 22 12:19:12 2014
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.10 (GNU/Linux)
+
+iQIcBAABAgAGBQJT9zPjAAoJEI77GWKQiPVlkT0P/R9eUJGisOgsWkTnC7qFSq60
+fw0GMg4NYNmnnecX4ghMF0ujScGaX02CNKXAFPOYQgJgP5iHDGf+hqkQ24FcvhgJ
+l9GOoaeCt8iCNBXlf8UpCE6SGXR7wHYxRZ61kebJfGDGil8cGGDcLoyUKmuldfLE
+VhjPCSTP+chOGxplMfqK9dvd91oGH8o0/IkLeuNnALoVb5exqym+8Qn8QO5v0z2n
+7SuYYibtqSSa4JWMpeKY6D8AKey4cZ/WMgPhOhvgxjCZPlKLd71pbGraXAsFkRlj
+pgkCG9Yjw1OifyeKi32k1NHOtm7yjO6PN+tQWceYT0yqQBHRAukWZBGrntJ3sOLy
+OZl//jhsxUJhdvAPRsBSVv0aIzbCMChCWsmvN1CJnlWI5bjhC16rhH2cLzMOMZzt
+DlcVWY2mIoyo2+OFHls7QNiJxM2ZhlkmRETXZ1CI6ggJIEEUfs+0Ln6Gz+jP9smP
+k7nmvvBrWP14fMSFGpfqjqALpe14Eo9m6t0UXMr6kC2HrvuA+HmohDWGDRsLe7Y8
+YyImHF7pYvMtv6352exJ5jeG9pIPe53IcZQssc9RgBYABIYxlx4wEtvSw7oxlBDa
+8Ex7Vmy85xucvlc56VwM+3CwjGKzvl6g0DAbhSFtIwKqt/FRIx/YjGpabX5rIVsp
+2PByMHzLQpAYJR4uGbq8
+=6Sik
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.2.28.tar.bz2.md5
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.bz2.md5 (added)
+++ dev/httpd/httpd-2.2.28.tar.bz2.md5 Fri Aug 22 12:19:12 2014
@@ -0,0 +1 @@
+778de80d3a1792ab468eab990f51b251 *httpd-2.2.28.tar.bz2
Added: dev/httpd/httpd-2.2.28.tar.bz2.sha1
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.bz2.sha1 (added)
+++ dev/httpd/httpd-2.2.28.tar.bz2.sha1 Fri Aug 22 12:19:12 2014
@@ -0,0 +1 @@
+f278fb46e66a9b3618474a53eba696e62956f953 *httpd-2.2.28.tar.bz2
Added: dev/httpd/httpd-2.2.28.tar.gz
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.2.28.tar.gz
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.2.28.tar.gz.asc
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.gz.asc (added)
+++ dev/httpd/httpd-2.2.28.tar.gz.asc Fri Aug 22 12:19:12 2014
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.10 (GNU/Linux)
+
+iQIcBAABAgAGBQJT9zPfAAoJEI77GWKQiPVlZzgP/jaZjDMQiHcCYi9wDofQq5lE
+qo5BrsOHk1Zb3ShOKxyHzjGa0HV6T73cyvibw9Yv7hlBI2RPyjwsZoYPKXY6kDJO
+VA6q+VZqjvnZERzULII0ew1HVmu6iCPHIcuMKLSbXVjM3lZoRaCgA+s8dv0PXmzW
+j6BZ5Hf2nS1uvy/S7DBWpBDt+TahsFmTHogG0XYNxedcoqwkGWH+fSVyURw696Bh
+J+WcbFp3USMfzk98mEjiDmruseuXR2IO/XE14EMcVwfyLp8QKDuFCXWJITHSYo2c
+Ab8BkXGemMxop+1aKzyzHBNchb6MOE7p8v6tBU8a7OsspEkWcUeYSxyN9mW9Cupf
+wN/iDZ/wJK91r8oEXBHOtRrN0UZYDgQ59fJEiETqsSSgyN4heUyXqg33DuJv7xMN
+nbRUBPplaPc4jx35g3oDDxSCBuUhY9ZTVZemv2ZOf/wURdJ06F79lvWBBOgdIcZy
+EfC1sH35iFFY7bhbZQn33KVyRpeB3KYbhUjHBt3jH14u0PS/XLSv1M2Um3QArwCq
+SJ1rjrl3LX2Ktm7tYOxZjEmf6MlMcgnaV/rwHiwbtHj77Y3IABDAsiuuWy0yns+A
+lpT/jrdl2U0JvEW6VPiQxV7NzJ/AjZQUUOo/movcPRwZrnvY5qmhe6hu9YNmFolG
+Ed63Ci35+GH1Oe0NqNM9
+=UPvA
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.2.28.tar.gz.md5
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.gz.md5 (added)
+++ dev/httpd/httpd-2.2.28.tar.gz.md5 Fri Aug 22 12:19:12 2014
@@ -0,0 +1 @@
+405caeb8909f4f34e40b910200e7cc55 *httpd-2.2.28.tar.gz
Added: dev/httpd/httpd-2.2.28.tar.gz.sha1
==============================================================================
--- dev/httpd/httpd-2.2.28.tar.gz.sha1 (added)
+++ dev/httpd/httpd-2.2.28.tar.gz.sha1 Fri Aug 22 12:19:12 2014
@@ -0,0 +1 @@
+269f0386ea51b32c13f2c9264d4ed3a04aab577e *httpd-2.2.28.tar.gz