You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2012/04/15 14:42:52 UTC
svn commit: r621 - in /dev/httpd: Announcement2.4.html Announcement2.4.txt
Author: jim
Date: Sun Apr 15 12:42:51 2012
New Revision: 621
Log:
Sync up
Modified:
dev/httpd/Announcement2.4.html
dev/httpd/Announcement2.4.txt
Modified: dev/httpd/Announcement2.4.html
==============================================================================
--- dev/httpd/Announcement2.4.html (original)
+++ dev/httpd/Announcement2.4.html Sun Apr 15 12:42:51 2012
@@ -15,20 +15,28 @@
<img src="../../images/apache_sub.gif" alt="" />
<h1>
- Apache HTTP Server 2.4.1 Released
+ Apache HTTP Server 2.4.2 Released
</h1>
<p>
The Apache Software Foundation and the Apache HTTP Server Project are
- pleased to announce the GA release of version 2.4.1 of the Apache
- HTTP Server ("Apache"). This version of Apache is our first GA
- release of the new generation 2.4.x branch of Apache HTTPD.
-</p>
+ pleased to announce the release of version 2.4.2 of the Apache
+ HTTP Server ("Apache"). This version of Apache is our 2nd GA
+ release of the new generation 2.4.x branch of Apache HTTPD. This
+ version of Apache is principally a security
+ and bug fix release, including the following security fix:
+</p>
+<ul>
+ <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883">CVE-2012-0883</a> (cve.mitre.org)
+ envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the
+ current working directory to be searched for DSOs.
+ </li>
+</ul>
<p>
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
</p>
<p>
- Apache HTTP Server 2.4.1 is available for download from:
+ Apache HTTP Server 2.4.2 is available for download from:
</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi"
@@ -36,7 +44,7 @@
</dl>
<p>
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.1 includes only
+ full list of changes. A condensed list, CHANGES_2.4.2 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
@@ -79,7 +87,7 @@
<p>
NOTE to Windows users: AcceptFilter None has replaced Win32DisableAcceptEx
and the feature appears to have interoperability issues with mod_ssl.
- Apache 2.4.1 may not yet be suitable for all Windows servers. There
+ Apache 2.4.2 may not yet be suitable for all Windows servers. There
is not yet a Windows binary distribution of httpd 2.4, but this is
expected to be remedied soon as various dependencies graduate from
beta to GA.
Modified: dev/httpd/Announcement2.4.txt
==============================================================================
--- dev/httpd/Announcement2.4.txt (original)
+++ dev/httpd/Announcement2.4.txt Sun Apr 15 12:42:51 2012
@@ -1,11 +1,17 @@
- Apache HTTP Server 2.4.1 Released
+ Apache HTTP Server 2.4.2 Released
- The Apache Software Foundation and the Apache HTTP Server Project are
- pleased to announce the GA release of version 2.4.1 of the Apache
- HTTP Server ("Apache"). This version of Apache is our first GA
- release of the new generation 2.4.x branch of Apache HTTPD.
+ The Apache Software Foundation and the Apache HTTP Server Project
+ are pleased to announce the release of version 2.4.2 of the Apache
+ HTTP Server ("Apache"). This version of Apache is our 2nd GA
+ release of the new generation 2.4.x branch of Apache HTTPD. This
+ version of Apache is principally a security and bug fix release,
+ including the following security fix:
+
+ *) SECURITY: CVE-2012-0883 (cve.mitre.org)
+ envvars: Fix insecure handling of LD_LIBRARY_PATH that could
+ lead to the current working directory to be searched for DSOs.
- Apache HTTP Server 2.4.1 is available for download from:
+ Apache HTTP Server 2.4.2 is available for download from:
http://httpd.apache.org/download.cgi
@@ -16,7 +22,12 @@
http://httpd.apache.org/docs/trunk/new_features_2_4.html
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes.
+ full list of changes. A condensed list, CHANGES_2.4.2 includes only
+ those changes introduced since the prior 2.4 release. A summary of all
+ of the security vulnerabilities addressed in this and earlier releases
+ is available:
+
+ http://httpd.apache.org/security/vulnerabilities_24.html
This release requires the Apache Portable Runtime (APR) version 1.4.x
and APR-Util version 1.4.x. The APR libraries must be upgraded for all
@@ -35,7 +46,7 @@
NOTE to Windows users: AcceptFilter None has replaced Win32DisableAcceptEx
and the feature appears to have interoperability issues with mod_ssl.
- Apache 2.4.1 may not yet be suitable for all Windows servers. There
+ Apache 2.4.2 may not yet be suitable for all Windows servers. There
is not yet a Windows binary distribution of httpd 2.4, but this is
expected to be remedied soon as various dependencies graduate from
beta to GA.