You are viewing a plain text version of this content. The canonical link for it is here.

Posted to cvs@httpd.apache.org by co...@apache.org on 2024/05/16 17:54:35 UTC

svn commit: r1917769 - /httpd/httpd/branches/2.4.x/CHANGES

Author: covener
Date: Thu May 16 17:54:35 2024
New Revision: 1917769

URL: http://svn.apache.org/viewvc?rev=1917769&view=rev
Log:
add warning about behavior change

Modified:
    httpd/httpd/branches/2.4.x/CHANGES

Modified: httpd/httpd/branches/2.4.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?rev=1917769&r1=1917768&r2=1917769&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.4.x/CHANGES [utf-8] Thu May 16 17:54:35 2024
@@ -17,8 +17,12 @@ Changes with Apache 2.4.59
      Server allows an attacker that can inject malicious response
      headers into backend applications to cause an HTTP
      desynchronization attack.
-     Users are recommended to upgrade to version 2.4.59, which fixes
-     this issue.
+
+     After this change, CGI-like scripts cannot set Transfer-Encoding
+     or Content-Length headers.  To restore the ability to set Content-Length
+     header, set per-request environment variable 'ap_trust_cgilike_cl' to any
+     non-empty value.
+
      Credits: Keran Mu, Tsinghua University and Zhongguancun
      Laboratory.