You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ic...@apache.org on 2021/09/15 08:10:07 UTC
svn commit: r49942 - /dev/httpd/ /release/httpd/
Author: icing
Date: Wed Sep 15 08:10:06 2021
New Revision: 49942
Log:
Add release httpd-2.4.49 from voted 2.4.49-rc1
Added:
release/httpd/CHANGES_2.4.49
- copied unchanged from r49941, dev/httpd/CHANGES_2.4.49
release/httpd/httpd-2.4.49.tar.bz2
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2
release/httpd/httpd-2.4.49.tar.bz2.asc
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2.asc
release/httpd/httpd-2.4.49.tar.bz2.md5
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2.md5
release/httpd/httpd-2.4.49.tar.bz2.sha1
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha1
release/httpd/httpd-2.4.49.tar.bz2.sha256
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha256
release/httpd/httpd-2.4.49.tar.bz2.sha512
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha512
release/httpd/httpd-2.4.49.tar.gz
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz
release/httpd/httpd-2.4.49.tar.gz.asc
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz.asc
release/httpd/httpd-2.4.49.tar.gz.md5
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz.md5
release/httpd/httpd-2.4.49.tar.gz.sha1
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz.sha1
release/httpd/httpd-2.4.49.tar.gz.sha256
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz.sha256
release/httpd/httpd-2.4.49.tar.gz.sha512
- copied unchanged from r49941, dev/httpd/httpd-2.4.49-rc1.tar.gz.sha512
Removed:
dev/httpd/CHANGES_2.4
dev/httpd/CHANGES_2.4.49
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2.asc
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2.md5
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2.sha1
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2.sha256
dev/httpd/httpd-2.4.49-rc1-deps.tar.bz2.sha512
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz.asc
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz.md5
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz.sha1
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz.sha256
dev/httpd/httpd-2.4.49-rc1-deps.tar.gz.sha512
dev/httpd/httpd-2.4.49-rc1.tar.bz2
dev/httpd/httpd-2.4.49-rc1.tar.bz2.asc
dev/httpd/httpd-2.4.49-rc1.tar.bz2.md5
dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha1
dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha256
dev/httpd/httpd-2.4.49-rc1.tar.bz2.sha512
dev/httpd/httpd-2.4.49-rc1.tar.gz
dev/httpd/httpd-2.4.49-rc1.tar.gz.asc
dev/httpd/httpd-2.4.49-rc1.tar.gz.md5
dev/httpd/httpd-2.4.49-rc1.tar.gz.sha1
dev/httpd/httpd-2.4.49-rc1.tar.gz.sha256
dev/httpd/httpd-2.4.49-rc1.tar.gz.sha512
Modified:
release/httpd/Announcement2.4.html
release/httpd/Announcement2.4.txt
release/httpd/CHANGES_2.4
Modified: release/httpd/Announcement2.4.html
==============================================================================
--- release/httpd/Announcement2.4.html (original)
+++ release/httpd/Announcement2.4.html Wed Sep 15 08:10:06 2021
@@ -49,15 +49,15 @@
<div class="banner"></div>
<h1>
- Apache HTTP Server 2.4.48 Released
+ Apache HTTP Server 2.4.49 Released
</h1>
<p>
- June 01, 2021
+ September 15, 2021
</p>
<p>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to <a href="https://www.apache.org/dist/httpd/Announcement2.4.html">announce</a>
- the release of version 2.4.48 of the Apache
+ the release of version 2.4.49 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
@@ -69,7 +69,7 @@
encourage users of all prior versions to upgrade.
</p>
<p>
- Apache HTTP Server 2.4.48 is available for download from:
+ Apache HTTP Server 2.4.49 is available for download from:
</p>
<dl>
<dd><a href="https://httpd.apache.org/download.cgi"
@@ -77,7 +77,7 @@
</dl>
<p>
Please see the <a href="./CHANGES_2.4">CHANGES_2.4</a> file, linked from the download page, for a
- full list of changes. A condensed list, <a href="./CHANGES_2.4.48">CHANGES_2.4.48</a> includes only
+ full list of changes. A condensed list, <a href="./CHANGES_2.4.49">CHANGES_2.4.49</a> includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/Announcement2.4.txt
==============================================================================
--- release/httpd/Announcement2.4.txt (original)
+++ release/httpd/Announcement2.4.txt Wed Sep 15 08:10:06 2021
@@ -1,9 +1,9 @@
- Apache HTTP Server 2.4.48 Released
+ Apache HTTP Server 2.4.49 Released
- June 01, 2021
+ September 15, 2021
The Apache Software Foundation and the Apache HTTP Server Project
- are pleased to announce the release of version 2.4.48 of the Apache
+ are pleased to announce the release of version 2.4.49 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
@@ -13,7 +13,7 @@
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
- Apache HTTP Server 2.4.48 is available for download from:
+ Apache HTTP Server 2.4.49 is available for download from:
https://httpd.apache.org/download.cgi
@@ -24,7 +24,7 @@
https://httpd.apache.org/docs/trunk/new_features_2_4.html
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.48 includes only
+ full list of changes. A condensed list, CHANGES_2.4.49 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/CHANGES_2.4
==============================================================================
--- release/httpd/CHANGES_2.4 (original)
+++ release/httpd/CHANGES_2.4 Wed Sep 15 08:10:06 2021
@@ -1,4 +1,139 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.4.49
+
+ *) core/mod_proxy/mod_ssl:
+ Adding `outgoing` flag to conn_rec, indicating a connection is
+ initiated by the server to somewhere, in contrast to incoming
+ connections from clients.
+ Adding 'ap_ssl_bind_outgoing()` function that marks a connection
+ as outgoing and is used by mod_proxy instead of the previous
+ optional function `ssl_engine_set`. This enables other SSL
+ module to secure proxy connections.
+ The optional functions `ssl_engine_set`, `ssl_engine_disable` and
+ `ssl_proxy_enable` are now provided by the core to have backward
+ compatibility with non-httpd modules that might use them. mod_ssl
+ itself no longer registers these functions, but keeps them in its
+ header for backward compatibility.
+ The core provided optional function wrap any registered function
+ like it was done for `ssl_is_ssl`.
+ [Stefan Eissing]
+
+ *) mod_ssl: Support logging private key material for use with
+ wireshark via log file given by SSLKEYLOGFILE environment
+ variable. Requires OpenSSL 1.1.1. PR 63391. [Joe Orton]
+
+ *) mod_proxy: Do not canonicalize the proxied URL when both "nocanon" and
+ "ProxyPassInterpolateEnv On" are configured. PR 65549.
+ [Joel Self <joelself gmail.com>]
+
+ *) mpm_event: Fix children processes possibly not stopped on graceful
+ restart. PR 63169. [Joel Self <joelself gmail.com>]
+
+ *) mod_proxy: Fix a potential infinite loop when tunneling Upgrade(d)
+ protocols from mod_proxy_http, and a timeout triggering falsely when
+ using mod_proxy_wstunnel, mod_proxy_connect or mod_proxy_http with
+ upgrade= setting. PRs 65521 and 65519. [Yann Ylavic]
+
+ *) mod_unique_id: Reduce the time window where duplicates may be generated
+ PR 65159
+ [Christophe Jaillet]
+
+ *) mpm_prefork: Block signals for child_init hooks to prevent potential
+ threads created from there to catch MPM's signals.
+ [Ruediger Pluem, Yann Ylavic]
+
+ *) Revert "mod_unique_id: Fix potential duplicated ID generation under heavy load.
+ PR 65159" added in 2.4.47.
+ This causes issue on Windows.
+ [Christophe Jaillet]
+
+ *) mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker. [Yann Ylavic]
+
+ *) mod_md: Certificate/keys pairs are verified as matching before a renewal is accepted
+ as successful or a staged renewal is replacing the existing certificates.
+ This avoid potential mess ups in the md store file system to render the active
+ certificates non-working. [@mkauf]
+
+ *) mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
+ [Yann Ylavic]
+
+ *) mod_ssl: tighten the handling of ALPN for outgoing (proxy)
+ connections. If ALPN protocols are provided and sent to the
+ remote server, the received protocol selected is inspected
+ and checked for a match. Without match, the peer handshake
+ fails.
+ An exception is the proposal of "http/1.1" where it is
+ accepted if the remote server did not answer ALPN with
+ a selected protocol. This accomodates for hosts that do
+ not observe/support ALPN and speak http/1.x be default.
+
+ *) mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match worker instances
+ with others when their URLs contain a '$' substitution. PR 65419 + 65429.
+ [Yann Ylavic]
+
+ *) mod_dav: Add method_precondition hook. WebDAV extensions define
+ conditions that must exist before a WebDAV method can be executed.
+ This hook allows a WebDAV extension to verify these preconditions.
+ [Graham Leggett]
+
+ *) Add hooks deliver_report and gather_reports to mod_dav.h. Allows other
+ modules apart from versioning implementations to handle the REPORT method.
+ [Graham Leggett]
+
+ *) Add dav_get_provider(), dav_open_lockdb(), dav_close_lockdb() and
+ dav_get_resource() to mod_dav.h. [Graham Leggett]
+
+ *) core: fix ap_escape_quotes substitution logic. [Eric Covener]
+
+ *) Easy patches: synch 2.4.x and trunk
+ - mod_auth_basic: Use ap_cstr_casecmp instead of strcasecmp.
+ - mod_ldap: log and abort locking errors.
+ - mod_ldap: style fix for r1831165
+ - mod_ldap: build break fix for r1831165
+ - mod_deflate: Avoid hard-coded "%ld" format strings in mod_deflate's logging statements
+ - mod_deflate: Use apr_uint64_t instead of uint64_t (follow up to r1849590)
+ - mod_forensic: Follow up to r1856490: missing one mod_log_forensic test_char_table case.
+ - mod_rewrite: Save a few cycles.
+ - mod_request: Fix a comment (missing '_' in 'keep_body') and some style issues
+ - core: remove extra whitespace in HTTP_NOT_IMPLEMENTED
+ [Christophe Jaillet]
+
+ *) core/mpm: add hook 'child_stopping` that gets called when the MPM is
+ stopping a child process. The additional `graceful` parameter allows
+ registered hooks to free resources early during a graceful shutdown.
+ [Yann Ylavic, Stefan Eissing]
+
+ *) mod_proxy: Fix icomplete initialization of BalancerMember(s) from the
+ balancer-manager, which can lead to a crash. [Yann Ylavic]
+
+ *) mpm_event: Fix graceful stop/restart of children processes if connections
+ are in lingering close for too long. [Yann Ylavic]
+
+ *) mod_md: fixed a potential null pointer dereference if ACME/OCSP
+ server returned 2xx responses without content type. Reported by chuangwen.
+ [chuangwen, Stefan Eissing]
+
+ *) mod_md:
+ - Domain names in `<MDomain ...>` can now appear in quoted form.
+ - Fixed a failure in ACME challenge selection that aborted further searches
+ when the tls-alpn-01 method did not seem to be suitable.
+ - Changed the tls-alpn-01 setup to only become unsuitable when none of the
+ dns names showed support for a configured 'Protocols ... acme-tls/1'. This
+ allows use of tls-alpn-01 for dns names that are not mapped to a VirtualHost.
+ [Stefan Eissing]
+
+ *) Add CPING to health check logic. [Jean-Frederic Clere]
+
+ *) core: Split ap_create_request() from ap_read_request(). [Graham Leggett]
+
+ *) core, h2: common ap_parse_request_line() and ap_check_request_header()
+ code. [Yann Ylavic]
+
+ *) core: Add StrictHostCheck to allow unconfigured hostnames to be
+ rejected. [Eric Covener]
+
+ *) htcacheclean: Improve help messages. [Christophe Jaillet]
+
Changes with Apache 2.4.48
*) SECURITY: CVE-2021-31618 (cve.mitre.org)