You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by wr...@apache.org on 2014/03/18 20:57:20 UTC
svn commit: r4744 - in /dev/httpd: CHANGES_2.2 CHANGES_2.2.26 CHANGES_2.2.27
Author: wrowe
Date: Tue Mar 18 19:57:20 2014
New Revision: 4744
Log:
Prep 2.2.27 CHANGES
Added:
dev/httpd/CHANGES_2.2.27
Removed:
dev/httpd/CHANGES_2.2.26
Modified:
dev/httpd/CHANGES_2.2
Modified: dev/httpd/CHANGES_2.2
==============================================================================
--- dev/httpd/CHANGES_2.2 (original)
+++ dev/httpd/CHANGES_2.2 Tue Mar 18 19:57:20 2014
@@ -1,4 +1,39 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.2.27
+
+ *) SECURITY: CVE-2014-0098 (cve.mitre.org)
+ Clean up cookie logging with fewer redundant string parsing passes.
+ Log only cookies with a value assignment. Prevents segfaults when
+ logging truncated cookies.
+ [William Rowe, Ruediger Pluem, Jim Jagielski]
+
+ *) SECURITY: CVE-2013-6438 (cve.mitre.org)
+ mod_dav: Keep track of length of cdata properly when removing
+ leading spaces. Eliminates a potential denial of service from
+ specifically crafted DAV WRITE requests
+ [Amin Tora <Amin.Tora neustar.biz>]
+
+ *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
+ TE/CL conflicts. [Yann Ylavic <ylavic.dev gmail com>, Jim Jagielski]
+
+ *) mod_proxy_http: Core dumped under high load. PR 50335.
+ [Jan Kaluza <jkaluza redhat.com>]
+
+ *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+ [Christophe Jaillet]
+
+ *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which
+ is equivalent to <ProxyMatch wildcard-url>. [Christophe Jaillet]
+
+ *) mod_ldap: Fix a potential memory leak or corruption. PR 54936.
+ [Zhenbo Xu <zhenbo1987 gmail com>]
+
+ *) mod_ssl: Do not perform SNI / Host header comparison in case of a
+ forward proxy request. [Ruediger Pluem]
+
+ *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows.
+ PR46679 [Bob Ionescu]
+
Changes with Apache 2.2.26
*) mod_dav: dav_resource->uri treated as unencoded. This was an
@@ -994,6 +1029,8 @@ Changes with Apache 2.2.10
mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
the FTP URL. Discovered by Marc Bevand of Rapid7. [Ruediger Pluem]
+ *) mod_authz_host: Add support for env=!envvar [Jim Jagielski]
+
*) Allow for smax to be 0 for balancer members so that all idle
connections are able to be dropped should they exceed ttl.
PR 43371 [Phil Endecott <spam_from_apache_bugzilla chezphil.org>,
Added: dev/httpd/CHANGES_2.2.27
==============================================================================
--- dev/httpd/CHANGES_2.2.27 (added)
+++ dev/httpd/CHANGES_2.2.27 Tue Mar 18 19:57:20 2014
@@ -0,0 +1,36 @@
+ -*- coding: utf-8 -*-
+Changes with Apache 2.2.27
+
+ *) SECURITY: CVE-2014-0098 (cve.mitre.org)
+ Clean up cookie logging with fewer redundant string parsing passes.
+ Log only cookies with a value assignment. Prevents segfaults when
+ logging truncated cookies.
+ [William Rowe, Ruediger Pluem, Jim Jagielski]
+
+ *) SECURITY: CVE-2013-6438 (cve.mitre.org)
+ mod_dav: Keep track of length of cdata properly when removing
+ leading spaces. Eliminates a potential denial of service from
+ specifically crafted DAV WRITE requests
+ [Amin Tora <Amin.Tora neustar.biz>]
+
+ *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
+ TE/CL conflicts. [Yann Ylavic <ylavic.dev gmail com>, Jim Jagielski]
+
+ *) mod_proxy_http: Core dumped under high load. PR 50335.
+ [Jan Kaluza <jkaluza redhat.com>]
+
+ *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+ [Christophe Jaillet]
+
+ *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which
+ is equivalent to <ProxyMatch wildcard-url>. [Christophe Jaillet]
+
+ *) mod_ldap: Fix a potential memory leak or corruption. PR 54936.
+ [Zhenbo Xu <zhenbo1987 gmail com>]
+
+ *) mod_ssl: Do not perform SNI / Host header comparison in case of a
+ forward proxy request. [Ruediger Pluem]
+
+ *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows.
+ PR46679 [Bob Ionescu]
+