You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2024/07/17 18:20:33 UTC
svn commit: r70372 - /release/httpd/
Author: covener
Date: Wed Jul 17 18:20:32 2024
New Revision: 70372
Log:
publishing release httpd-2.4.62
Added:
release/httpd/CURRENT-IS-2.4.62
Removed:
release/httpd/CURRENT-IS-2.4.61
release/httpd/httpd-2.4.61.tar.bz2
release/httpd/httpd-2.4.61.tar.bz2.asc
release/httpd/httpd-2.4.61.tar.bz2.sha256
release/httpd/httpd-2.4.61.tar.bz2.sha512
release/httpd/httpd-2.4.61.tar.gz
release/httpd/httpd-2.4.61.tar.gz.asc
release/httpd/httpd-2.4.61.tar.gz.sha256
release/httpd/httpd-2.4.61.tar.gz.sha512
Modified:
release/httpd/CHANGES_2.4
release/httpd/CHANGES_2.4.62
Modified: release/httpd/CHANGES_2.4
==============================================================================
--- release/httpd/CHANGES_2.4 (original)
+++ release/httpd/CHANGES_2.4 Wed Jul 17 18:20:32 2024
@@ -1,6 +1,26 @@
-*- coding: utf-8 -*-
Changes with Apache 2.4.62
+ *) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
+ mod_rewrite in server/vhost context on Windows (cve.mitre.org)
+ SSRF in Apache HTTP Server on Windows with mod_rewrite in
+ server/vhost context, allows to potentially leak NTML hashes to
+ a malicious server via SSRF and malicious requests.
+ Users are recommended to upgrade to version 2.4.62 which fixes
+ this issue.
+ Credits: Smi1e (DBAPPSecurity Ltd.)
+
+ *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
+ disclosure with handlers configured via AddType (cve.mitre.org)
+ A partial fix for CVE-2024-39884 in the core of Apache HTTP
+ Server 2.4.61 ignores some use of the legacy content-type based
+ configuration of handlers. "AddType" and similar configuration,
+ under some circumstances where files are requested indirectly,
+ result in source code disclosure of local content. For example,
+ PHP scripts may be served instead of interpreted.
+ Users are recommended to upgrade to version 2.4.62, which fixes
+ this issue.
+
*) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
"balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
with BalancerMember(s). PR 69168. [Yann Ylavic]
Modified: release/httpd/CHANGES_2.4.62
==============================================================================
--- release/httpd/CHANGES_2.4.62 (original)
+++ release/httpd/CHANGES_2.4.62 Wed Jul 17 18:20:32 2024
@@ -1,6 +1,26 @@
-*- coding: utf-8 -*-
Changes with Apache 2.4.62
+ *) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
+ mod_rewrite in server/vhost context on Windows (cve.mitre.org)
+ SSRF in Apache HTTP Server on Windows with mod_rewrite in
+ server/vhost context, allows to potentially leak NTML hashes to
+ a malicious server via SSRF and malicious requests.
+ Users are recommended to upgrade to version 2.4.62 which fixes
+ this issue.
+ Credits: Smi1e (DBAPPSecurity Ltd.)
+
+ *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
+ disclosure with handlers configured via AddType (cve.mitre.org)
+ A partial fix for CVE-2024-39884 in the core of Apache HTTP
+ Server 2.4.61 ignores some use of the legacy content-type based
+ configuration of handlers. "AddType" and similar configuration,
+ under some circumstances where files are requested indirectly,
+ result in source code disclosure of local content. For example,
+ PHP scripts may be served instead of interpreted.
+ Users are recommended to upgrade to version 2.4.62, which fixes
+ this issue.
+
*) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
"balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
with BalancerMember(s). PR 69168. [Yann Ylavic]
Added: release/httpd/CURRENT-IS-2.4.62
==============================================================================
(empty)