You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2005/10/10 20:05:55 UTC
svn commit: r312704 - in /httpd/httpd/dist: Announcement.html
Announcement.txt
Author: jim
Date: Mon Oct 10 11:05:52 2005
New Revision: 312704
URL: http://svn.apache.org/viewcvs?rev=312704&view=rev
Log:
Reverse preload - prevent site update
Modified:
httpd/httpd/dist/Announcement.html
httpd/httpd/dist/Announcement.txt
Modified: httpd/httpd/dist/Announcement.html
URL: http://svn.apache.org/viewcvs/httpd/httpd/dist/Announcement.html?rev=312704&r1=312703&r2=312704&view=diff
==============================================================================
--- httpd/httpd/dist/Announcement.html (original)
+++ httpd/httpd/dist/Announcement.html Mon Oct 10 11:05:52 2005
@@ -15,34 +15,45 @@
<IMG SRC="../../images/apache_sub.gif" ALT="">
-<h1>Apache HTTP Server 1.3.34 Released</h1>
+<h1>Apache HTTP Server 1.3.33 Released</h1>
<p> The Apache Software Foundation and The Apache HTTP Server Project are
- pleased to announce the release of version 1.3.34 of the Apache HTTP
+ pleased to announce the release of version 1.3.33 of the Apache HTTP
Server ("Apache"). This Announcement notes the significant changes
- in 1.3.34 as compared to 1.3.33.</p>
+ in 1.3.33 as compared to 1.3.31 (1.3.32 was not formally released).
+ The Announcement is also available in German and Japanese from:</p>
+<dl>
+ <dd><a href="http://www.apache.org/dist/httpd/Announcement.html.de"
+ >http://www.apache.org/dist/httpd/Announcement.html.de</a></dd>
+<!-- <dd><a href="http://www.apache.org/dist/httpd/Announcement.txt.es"
+ >http://www.apache.org/dist/httpd/Announcement.txt.es</a></dd> -->
+ <dd><a href="http://www.apache.org/dist/httpd/Announcement.txt.ja"
+ >http://www.apache.org/dist/httpd/Announcement.txt.ja</a></dd>
+</dl>
<p>This version of Apache is principally a bug and security fix release.
A partial summary of the bug fixes is given at the end of this document.
A full listing of changes can be found in the CHANGES file. Of
- particular note is that 1.3.34 addresses and fixes 2 potential
+ particular note is that 1.3.33 addresses and fixes 2 potential
security issues:</p>
<ul>
-<li>If a request contains both Transfer-Encoding and
- Content-Length headers, remove the Content-Length, mitigating some
- HTTP Request Splitting/Spoofing attacks.</li>
-
-<li>Added TraceEnable [on|off|extended] per-server directive to alter
- the behavior of the TRACE method.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940">
+ CAN-2004-0940 (cve.mitre.org)</a><br>
+ Fix potential buffer overflow with escaped characters in
+ SSI tag string.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">
+ CAN-2004-0492 (cve.mitre.org)</a><br>
+ Reject responses from a remote server if sent an invalid
+ (negative) Content-Length.</li>
</ul>
-<p>We consider Apache 1.3.34 to be the best version of Apache 1.3 available
+<p>We consider Apache 1.3.33 to be the best version of Apache 1.3 available
and we strongly recommend that users of older versions, especially of
the 1.1.x and 1.2.x family, upgrade as soon as possible. No further
releases will be made in the 1.2.x family.</p>
-<p>Apache 1.3.34 is available for download from</p>
+<p>Apache 1.3.33 is available for download from</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi">http://httpd.apache.org/download.cgi</a></dd>
</dl>
@@ -92,7 +103,7 @@
<p>Apache 2.0 has been structured for multiple operating systems from its
inception, by introducing the Apache Portability Library and MPM modules.
- Users on Unix and non-Unix platforms are strongly encouraged to move up to
+ Users on non-Unix platforms are strongly encouraged to move up to
Apache 2.0 for better performance, stability and security on their
platforms.</p>
@@ -100,41 +111,65 @@
of the servers on the Internet are running Apache or one of its
variants.</p>
-<h2>Apache 1.3.34 Major changes</h2>
+<h2>Apache 1.3.33 Major changes</h2>
<h3>Security vulnerabilities</h3>
<p>
- The main security vulnerabilities addressed in 1.3.34 are:
+ The main security vulnerabilities addressed in 1.3.33 are:
</p>
<ul>
-<li>If a request contains both Transfer-Encoding and
- Content-Length headers, remove the Content-Length, mitigating some
- HTTP Request Splitting/Spoofing attacks.</li>
-
-<li>Added TraceEnable [on|off|extended] per-server directive to alter
- the behavior of the TRACE method.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940">
+ CAN-2004-0940 (cve.mitre.org)</a><br>
+ Fix potential buffer overflow with escaped characters in
+ SSI tag string.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">
+ CAN-2004-0492 (cve.mitre.org)</a><br>
+ Reject responses from a remote server if sent an invalid
+ (negative) Content-Length.</li>
</ul>
<h3>New features</h3>
<p>
New features that relate to specific platforms:
</p>
<ul>
- <li>None</li>
+ <li>Win32: Improve error reporting after a failed attempt to spawn a
+ piped log process or rewrite map process.</li>
</ul>
<p>
New features that relate to specific platforms:
</p>
<ul>
- <li>None</li>
+ <li>Added new compile-time flag: <code>UCN_OFF_HONOR_PHYSICAL_PORT</code>.
+ It controls how <code>UseCanonicalName Off</code> determines the port value if
+ the client doesn't provide one in the <code>Host</code> header. If defined during
+ compilation, <code>UseCanonicalName Off</code> will use the physical port number
+ to generate the canonical name. If not defined, it tries the current
+ <code>Port</code> value followed by the default port for the current scheme.</li>
</ul>
<p>
<h3>Bugs fixed</h3>
<p>
- The following bugs were found in Apache 1.3.33 (or earlier) and have been fixed in
- Apache 1.3.34:
+ The following bugs were found in Apache 1.3.31 (or earlier) and have been fixed in
+ Apache 1.3.33:
</p>
<ul>
- <li><code>mod_digest</code>: Fix another nonce string calculation issue.</li>
+ <li><code>mod_rewrite</code>: Fix query string handling for proxied URLs. PR 14518.</li>
+
+ <li><code>mod_rewrite</code>: Fix 0 bytes write into random memory position.
+ PR 31036.</li>
+
+ <li><code>mod_digest</code>: Fix nonce string calculation since 1.3.31 which
+ would force re-authentication for every connection if
+ <code>AuthDigestRealmSeed</code> was not configured. PR 30920.</li>
+
+ <li>Fix trivial bug in <code>mod_log_forensic</code> that caused the child
+ to seg fault when certain invalid requests were fired at it with
+ forensic logging is enabled. PR 29313.</li>
+
+ <li>No longer breaks mod_dav, frontpage and others. Repair a patch
+ in 1.3.31 which prevented discarding the request body for requests
+ that will be keptalive but are not currently keptalive. PR 29237.</li>
+</li>
</ul>
</BODY>
Modified: httpd/httpd/dist/Announcement.txt
URL: http://svn.apache.org/viewcvs/httpd/httpd/dist/Announcement.txt?rev=312704&r1=312703&r2=312704&view=diff
==============================================================================
--- httpd/httpd/dist/Announcement.txt (original)
+++ httpd/httpd/dist/Announcement.txt Mon Oct 10 11:05:52 2005
@@ -1,11 +1,10 @@
- Apache HTTP Server 1.3.34 Released
+ Apache HTTP Server 1.3.33 Released
The Apache Software Foundation and The Apache HTTP Server Project are
- pleased to announce the release of version 1.3.34 of the Apache HTTP
+ pleased to announce the release of version 1.3.33 of the Apache HTTP
Server ("Apache"). This Announcement notes the significant changes
- in 1.3.34 as compared to 1.3.33.
-
+ in 1.3.33 as compared to 1.3.31 (1.3.32 was not formally released).
The Announcement is also available in German and Japanese from:
http://www.apache.org/dist/httpd/Announcement.txt.de
@@ -14,22 +13,23 @@
This version of Apache is principally a bug and security fix release.
A partial summary of the bug fixes is given at the end of this document.
A full listing of changes can be found in the CHANGES file. Of
- particular note is that 1.3.34 addresses and fixes 2 potential
+ particular note is that 1.3.33 addresses and fixes 2 potential
security issues:
- o If a request contains both Transfer-Encoding and
- Content-Length headers, remove the Content-Length, mitigating some
- HTTP Request Splitting/Spoofing attacks.
-
- o Added TraceEnable [on|off|extended] per-server directive to alter
- the behavior of the TRACE method.
+ o CAN-2004-0940 (cve.mitre.org)
+ Fix potential buffer overflow with escaped characters in
+ SSI tag string.
+
+ o CAN-2004-0492 (cve.mitre.org)
+ Reject responses from a remote server if sent an invalid
+ (negative) Content-Length.
- We consider Apache 1.3.34 to be the best version of Apache 1.3 available
+ We consider Apache 1.3.33 to be the best version of Apache 1.3 available
and we strongly recommend that users of older versions, especially of
the 1.1.x and 1.2.x family, upgrade as soon as possible. No further
releases will be made in the 1.2.x family.
- Apache 1.3.34 is available for download from:
+ Apache 1.3.33 is available for download from:
http://httpd.apache.org/download.cgi
@@ -74,40 +74,56 @@
Apache 2.0 has been structured for multiple operating systems from its
inception, by introducing the Apache Portability Library and MPM modules.
- Users on Unix and non-Unix platforms are strongly encouraged to move up
- to Apache 2.0 for better performance, stability and security on their
+ Users on non-Unix platforms are strongly encouraged to move up to
+ Apache 2.0 for better performance, stability and security on their
platforms.
- Apache 1.3.34 Major changes
+ Apache 1.3.33 Major changes
Security vulnerabilities
- * SECURITY: core: If a request contains both Transfer-Encoding and
- Content-Length headers, remove the Content-Length, mitigating some
- HTTP Request Splitting/Spoofing attacks. This has no impact on
- mod_proxy_http, yet affects any module which supports chunked
- encoding yet fails to prefer T-E: chunked over the Content-Length
- purported value.
-
- * Added TraceEnable [on|off|extended] per-server directive to alter
- the behavior of the TRACE method. This addresses a flaw in proxy
- conformance to RFC 2616 - previously the proxy server would accept
- a TRACE request body although the RFC prohibited it. The default
- remains 'TraceEnable on'.
+ * CAN-2004-0940 (cve.mitre.org)
+ Fix potential buffer overflow with escaped characters in
+ SSI tag string.
+
+ * CAN-2004-0492 (cve.mitre.org)
+ Reject responses from a remote server if sent an invalid
+ (negative) Content-Length.
New features
New features that relate to specific platforms:
- * None
+ * Win32: Improve error reporting after a failed attempt to spawn a
+ piped log process or rewrite map process.
New features that relate to all platforms:
- * None
+ * Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT.
+ It controls how UseCanonicalName Off determines the port value if
+ the client doesn't provide one in the Host header. If defined during
+ compilation, UseCanonicalName Off will use the physical port number
+ to generate the canonical name. If not defined, it tries the current
+ Port value followed by the default port for the current scheme.
Bugs fixed
- The following noteworthy bugs were found in Apache 1.3.33 (or earlier)
- and have been fixed in Apache 1.3.34:
+ The following noteworthy bugs were found in Apache 1.3.31 (or earlier)
+ and have been fixed in Apache 1.3.33:
- * mod_digest: Fix another nonce string calculation issue.
+ * mod_rewrite: Fix query string handling for proxied URLs. PR 14518.
+
+ * mod_rewrite: Fix 0 bytes write into random memory position.
+ PR 31036.
+
+ * mod_digest: Fix nonce string calculation since 1.3.31 which
+ would force re-authentication for every connection if
+ AuthDigestRealmSeed was not configured. PR 30920.
+
+ * Fix trivial bug in mod_log_forensic that caused the child
+ to seg fault when certain invalid requests were fired at it with
+ forensic logging is enabled. PR 29313.
+
+ * No longer breaks mod_dav, frontpage and others. Repair a patch
+ in 1.3.31 which prevented discarding the request body for requests
+ that will be keptalive but are not currently keptalive. PR 29237.
Re: svn commit: r312704 - in /httpd/httpd/dist: Announcement.html
Announcement.txt
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
jim@apache.org wrote:
> Author: jim
> Date: Mon Oct 10 11:05:52 2005
> New Revision: 312704
>
> URL: http://svn.apache.org/viewcvs?rev=312704&view=rev
> Log:
> Reverse preload - prevent site update
Jim, nothing is cron'ned up to the website, and this is strictly the
/dist/httpd/ location. I think we are safe here letting the translators
attack these documents and organize them.
The only two folks I expect would push the website up to trunk are you,
or me, in the next few days. We can just sync. I'm actually hoping
that we blast the announcements in sync, so that 2.0 users aren't
compelled to downgrade to 1.3 this time around :)
Bill
Re: svn commit: r312704 - in /httpd/httpd/dist: Announcement.html
Announcement.txt
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
jim@apache.org wrote:
> Author: jim
> Date: Mon Oct 10 11:05:52 2005
> New Revision: 312704
>
> URL: http://svn.apache.org/viewcvs?rev=312704&view=rev
> Log:
> Reverse preload - prevent site update
Jim, nothing is cron'ned up to the website, and this is strictly the
/dist/httpd/ location. I think we are safe here letting the translators
attack these documents and organize them.
The only two folks I expect would push the website up to trunk are you,
or me, in the next few days. We can just sync. I'm actually hoping
that we blast the announcements in sync, so that 2.0 users aren't
compelled to downgrade to 1.3 this time around :)
Bill