You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2013/07/19 02:42:14 UTC
svn commit: r2515 - /release/httpd/
Author: jim
Date: Fri Jul 19 00:42:09 2013
New Revision: 2515
Log:
Allow mirrors to sync
Added:
release/httpd/CHANGES_2.4.6
release/httpd/httpd-2.4.6-deps.tar.bz2 (with props)
release/httpd/httpd-2.4.6-deps.tar.bz2.asc (with props)
release/httpd/httpd-2.4.6-deps.tar.bz2.md5
release/httpd/httpd-2.4.6-deps.tar.bz2.sha1
release/httpd/httpd-2.4.6-deps.tar.gz (with props)
release/httpd/httpd-2.4.6-deps.tar.gz.asc (with props)
release/httpd/httpd-2.4.6-deps.tar.gz.md5
release/httpd/httpd-2.4.6-deps.tar.gz.sha1
release/httpd/httpd-2.4.6.tar.bz2 (with props)
release/httpd/httpd-2.4.6.tar.bz2.asc (with props)
release/httpd/httpd-2.4.6.tar.bz2.md5
release/httpd/httpd-2.4.6.tar.bz2.sha1
release/httpd/httpd-2.4.6.tar.gz (with props)
release/httpd/httpd-2.4.6.tar.gz.asc (with props)
release/httpd/httpd-2.4.6.tar.gz.md5
release/httpd/httpd-2.4.6.tar.gz.sha1
release/httpd/httpd_2.4.6-netware-bin.zip (with props)
release/httpd/httpd_2.4.6-netware-bin.zip.asc (with props)
release/httpd/httpd_2.4.6-netware-bin.zip.md5
release/httpd/httpd_2.4.6-netware-bin.zip.sha1
release/httpd/httpd_2.4.6-netware-sdk.zip (with props)
release/httpd/httpd_2.4.6-netware-sdk.zip.asc (with props)
release/httpd/httpd_2.4.6-netware-sdk.zip.md5
release/httpd/httpd_2.4.6-netware-sdk.zip.sha1
Modified:
release/httpd/Announcement2.4.html
release/httpd/Announcement2.4.txt
release/httpd/CHANGES_2.4
Modified: release/httpd/Announcement2.4.html
==============================================================================
--- release/httpd/Announcement2.4.html (original)
+++ release/httpd/Announcement2.4.html Fri Jul 19 00:42:09 2013
@@ -15,34 +15,53 @@
<img src="../../images/apache_sub.gif" alt="" />
<h1>
- Apache HTTP Server 2.4.4 Released
+ Apache HTTP Server 2.4.6 Released
</h1>
<p>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to <a href="http://www.apache.org/dist/httpd/Announcement2.4.html">announce</a>
- the release of version 2.4.4 of the Apache
- HTTP Server ("Apache"). This version of Apache is our 3rd GA
+ the release of version 2.4.6 of the Apache
+ HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of
innovation by the project, and is recommended over all previous releases. This
- version of Apache is principally a security
- and bug fix release, including the following 2 security fixes:
+ release of Apache is principally a security
+ and bug fix release, including the following security fix:
</p>
<ul>
- <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499">CVE-2012-3499</a> (cve.mitre.org)
- Various XSS flaws due to unescaped hostnames and URIs HTML output in
- mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
+ <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1896">CVE-2013-1896</a> (cve.mitre.org)
+ Sending a MERGE request against a URI handled by mod_dav_svn with
+ the source href (sent as part of the request body as XML) pointing to a
+ URI that is not configured for DAV will trigger a segfault.
</li>
- <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558">CVE-2012-4558</a> (cve.mitre.org)
- XSS in mod_proxy_balancer manager interface.
+ <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2249">CVE-2013-2249</a> (cve.mitre.org)
+ mod_session_dbd: Make sure that dirty flag is respected when saving
+ sessions, and ensure the session ID is changed each time the session
+ changes. This changes the format of the updatesession SQL statement.
+ Existing configurations must be changed.
</li>
</ul>
<p>
+ Also in this release are some exciting new features including:
+</p>
+<ul>
+ <li> Major updates to mod_lua </li>
+ <li> Support for proxying websocket requests </li>
+ <li> Higher performant shm-based cache implementation </li>
+ <li> Addition of mod_macro for easier configuration management </li>
+</ul>
+<p>
+ As well as several exciting fixes, especially those related to RFC edge cases in mod_cache and mod_proxy.
+</p>
+<p>
+ NOTE: Apache httpd 2.4.5 was not released.
+</p>
+<p>
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
</p>
<p>
- Apache HTTP Server 2.4.4 is available for download from:
+ Apache HTTP Server 2.4.6 is available for download from:
</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi"
@@ -50,7 +69,7 @@
</dl>
<p>
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.4 includes only
+ full list of changes. A condensed list, CHANGES_2.4.6 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/Announcement2.4.txt
==============================================================================
--- release/httpd/Announcement2.4.txt (original)
+++ release/httpd/Announcement2.4.txt Fri Jul 19 00:42:09 2013
@@ -1,22 +1,42 @@
- Apache HTTP Server 2.4.4 Released
+ Apache HTTP Server 2.4.6 Released
The Apache Software Foundation and the Apache HTTP Server Project
- are pleased to announce the release of version 2.4.4 of the Apache
+ are pleased to announce the release of version 2.4.6 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
- recommended over all previous releases. This version of Apache is
+ recommended over all previous releases. This release of Apache is
principally a security and bug fix release, including the following
2 security fixes:
- *) SECURITY: CVE-2012-3499 (cve.mitre.org)
- Various XSS flaws due to unescaped hostnames and URIs HTML output in
- mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
+ *) SECURITY: CVE-2013-1896 (cve.mitre.org)
+ Sending a MERGE request against a URI handled by mod_dav_svn
+ with the source href (sent as part of the request body as XML)
+ pointing to a URI that is not configured for DAV will trigger a
+ segfault.
+
+ *) SECURITY: CVE-2013-2249 (cve.mitre.org)
+ mod_session_dbd: Make sure that dirty flag is respected when saving
+ sessions, and ensure the session ID is changed each time the session
+ changes. This changes the format of the updatesession SQL statement.
+ Existing configurations must be changed.
+
+ Also in this release are some exciting new features including:
+
+ *) Major updates to mod_lua
+ *) Support for proxying websocket requests
+ *) Higher performant shm-based cache implementation
+ *) Addition of mod_macro for easier configuration management
+
+ As well as several exciting fixes, especially those related to RFC edge
+ cases in mod_cache and mod_proxy.
- *) SECURITY: CVE-2012-4558 (cve.mitre.org)
- XSS in mod_proxy_balancer manager interface.
+ NOTE: Apache httpd 2.4.5 was not released.
- Apache HTTP Server 2.4.4 is available for download from:
+ We consider this release to be the best version of Apache available, and
+ encourage users of all prior versions to upgrade.
+
+ Apache HTTP Server 2.4.6 is available for download from:
http://httpd.apache.org/download.cgi
@@ -27,7 +47,7 @@
http://httpd.apache.org/docs/trunk/new_features_2_4.html
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.4 includes only
+ full list of changes. A condensed list, CHANGES_2.4.6 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/CHANGES_2.4
==============================================================================
--- release/httpd/CHANGES_2.4 (original)
+++ release/httpd/CHANGES_2.4 Fri Jul 19 00:42:09 2013
@@ -1,5 +1,277 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.4.6
+
+ *) Revert a broken fix for PR54948 that was applied to 2.4.5 (which was
+ not released) and found post-2.4.5 tagging.
+
+Changes with Apache 2.4.5
+
+ *) SECURITY: CVE-2013-1896 (cve.mitre.org)
+ mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with
+ the source href (sent as part of the request body as XML) pointing to a
+ URI that is not configured for DAV will trigger a segfault. [Ben Reser
+ <ben reser.org>]
+
+ *) SECURITY: CVE-2013-2249 (cve.mitre.org)
+ mod_session_dbd: Make sure that dirty flag is respected when saving
+ sessions, and ensure the session ID is changed each time the session
+ changes. This changes the format of the updatesession SQL statement.
+ Existing configurations must be changed.
+ [Takashi Sato <takashi tks.st>, Graham Leggett]
+
+ *) mod_auth_basic: Add a generic mechanism to fake basic authentication
+ using the ap_expr parser. AuthBasicFake allows the administrator to
+ construct their own username and password for basic authentication based
+ on their needs. [Graham Leggett]
+
+ *) mpm_event: Check that AsyncRequestWorkerFactor is not negative. PR 54254.
+ [Jackie Zhang <jackie qq zhang gmail com>]
+
+ *) mod_proxy: Ensure we don't attempt to amend a table we are iterating
+ through, ensuring that all headers listed by Connection are removed.
+ [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_proxy_http: Make the proxy-interim-response environment variable
+ effective by formally overriding origin server behaviour. [Graham
+ Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_proxy: Fix seg-faults when using the global pool on threaded
+ MPMs [Thomas Eckert <thomas.r.w.eckert gmail.com>, Graham Leggett,
+ Jim Jagielski]
+
+ *) mod_deflate: Remove assumptions as to when an EOS bucket might arrive.
+ Gracefully step aside if the body size is zero. [Graham Leggett]
+
+ *) mod_ssl: Fix possible truncation of OCSP responses when reading from the
+ server. [Joe Orton]
+
+ *) core: Support the SINGLE_LISTEN_UNSERIALIZED_ACCEPT optimization
+ on Linux kernel versions 3.x and above. PR 55121. [Bradley Heilbrun
+ <apache heilbrun.org>]
+
+ *) mod_cache_socache: Make sure the CacheSocacheMaxSize directive is merged
+ correctly. [Jens Låås <jelaas gmail.com>]
+
+ *) rotatelogs: add -n number-of-files option to roate through a number
+ of fixed-name logfiles. [Eric Covener]
+
+ *) mod_proxy: Support web-socket tunnels via mod_proxy_wstunnel.
+ [Jim Jagielski]
+
+ *) mod_cache_socache: Use the name of the socache implementation when performing
+ a lookup rather than using the raw arguments. [Martin Ksellmann
+ <ma...@ksellmann.de>]
+
+ *) core: Add dirwalk_stat hook. [Jeff Trawick]
+
+ *) core: Add post_perdir_config hook.
+ [Steinar Gunderson <sgunderson bigfoot.com>]
+
+ *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+ [Christophe Jaillet]
+
+ *) mod_remoteip: close file in error path. [Christophe Jaillet]
+
+ *) core: make the "default" parameter of the "ErrorDocument" option case
+ insensitive. PR 54419 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_proxy_html: make the "ProxyHTMLFixups" options case insensitive.
+ PR 54420 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_cache: Make option "CacheDisable" in mod_cache case insensitive.
+ PR 54462 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_cache: If a 304 response indicates an entity not currently cached, then
+ the cache MUST disregard the response and repeat the request without the
+ conditional. [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: Ensure that we don't attempt to replace a cached response
+ with an older response as per RFC2616 13.12. [Graham Leggett, Co-Advisor
+ <coad measurement-factory.com>]
+
+ *) core, mod_cache: Ensure RFC2616 compliance in ap_meets_conditions()
+ with weak validation combined with If-Range and Range headers. Break
+ out explicit conditional header checks to be useable elsewhere in the
+ server. Ensure weak validation RFC compliance in the byteranges filter.
+ Ensure RFC validation compliance when serving cached entities. PR 16142
+ [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) core: Add the ability to do explicit matching on weak and strong ETags
+ as per RFC2616 Section 13.3.3. [Graham Leggett, Co-Advisor
+ <coad measurement-factory.com>]
+
+ *) mod_cache: Ensure that updated responses to HEAD requests don't get
+ mistakenly paired with a previously cached body. Ensure that any existing
+ body is removed when a HEAD request is cached. [Graham Leggett,
+ Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: Honour Cache-Control: no-store in a request. [Graham Leggett]
+
+ *) mod_cache: Make sure that contradictory entity headers present in a 304
+ Not Modified response are caught and cause the entity to be removed.
+ [Graham Leggett]
+
+ *) mod_cache: Make sure Vary processing handles multivalued Vary headers and
+ multivalued headers referred to via Vary. [Graham Leggett]
+
+ *) mod_cache: When serving from cache, only the last header of a multivalued
+ header was taken into account. Fixed. Ensure that Warning headers are
+ correctly handled as per RFC2616. [Graham Leggett]
+
+ *) mod_cache: Ignore response headers specified by no-cache=header and
+ private=header as specified by RFC2616 14.9.1 What is Cacheable. Ensure
+ that these headers are still processed when multiple Cache-Control
+ headers are present in the response. PR 54706 [Graham Leggett,
+ Yann Ylavic <ylavic.dev gmail.com>]
+
+ *) mod_cache: Invalidate cached entities in response to RFC2616 Section
+ 13.10 Invalidation After Updates or Deletions. PR 15868 [Graham
+ Leggett]
+
+ *) mod_dav: Improve error handling in dav_method_put(), add new
+ dav_join_error() function. PR 54145. [Ben Reser <ben reser.org>]
+
+ *) mod_dav: Do not fail PROPPATCH when prop namespace is not known.
+ PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>]
+
+ *) mod_dav: When a PROPPATCH attempts to remove a non-existent dead
+ property on a resource for which there is no dead property in the same
+ namespace httpd segfaults. PR 52559 [Diego Santa Cruz
+ <diego.santaCruz spinetix.com>]
+
+ *) mod_dav: Sending an If or If-Match header with an invalid ETag doesn't
+ result in a 412 Precondition Failed for a COPY operation. PR54610
+ [Timothy Wood <tjw omnigroup.com>]
+
+ *) mod_dav: Make sure that when we prepare an If URL for Etag comparison,
+ we compare unencoded paths. PR 53910 [Timothy Wood <tjw omnigroup.com>]
+
+ *) 'AuthGroupFile' and 'AuthUserFile' do not accept anymore the optional
+ 'standard' keyword . It was unused and not documented.
+ PR54463 [Tianyin Xu <tixu cs.ucsd.edu> and Christophe Jaillet]
+
+ *) core: Do not over allocate memory within 'ap_rgetline_core' for
+ the common case. [Christophe Jaillet]
+
+ *) core: speed up (for common cases) and reduce memory usage of
+ ap_escape_logitem(). This should save 70-100 bytes in the request
+ pool for a default config. [Christophe Jaillet]
+
+ *) mod_dav: Ensure URI is correctly uriencoded on return. PR 54611
+ [Timothy Wood <tjw omnigroup.com>]
+
+ *) mod_proxy: Reject invalid values for Max-Forwards. [Graham Leggett,
+ Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: RFC2616 14.9.3 The s-maxage directive also implies the
+ semantics of the proxy-revalidate directive. [Graham Leggett]
+
+ *) mod_ssl: add support for subjectAltName-based host name checking
+ in proxy mode (SSLProxyCheckPeerName). PR 54030. [Kaspar Brand]
+
+ *) core: Use the proper macro for HTTP/1.1. [Graham Leggett]
+
+ *) event MPM: Provide error handling for ThreadStackSize. PR 54311
+ [Tianyin Xu <tixu cs.ucsd.edu>, Christophe Jaillet]
+
+ *) mod_dav: Do not segfault on PROPFIND with a zero length DBM.
+ PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>]
+
+ *) core: Improve error message where client's request-line exceeds
+ LimitRequestLine. PR 54384 [Christophe Jaillet]
+
+ *) mod_macro: New module that provides macros within configuration files.
+ [Fabien Coelho]
+
+ *) mod_cache_socache: New cache implementation backed by mod_socache
+ that replaces mod_mem_cache known from httpd 2.2. [Graham
+ Leggett]
+
+ *) htpasswd: Add -v option to verify a password. [Stefan Fritsch]
+
+ *) mod_proxy: Add BalancerInherit and ProxyPassInherit to control
+ whether Proxy Balancers and Workers are inherited by vhosts
+ (default is On). [Jim Jagielski]
+
+ *) mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind
+ password. [Daniel Ruggeri]
+
+ *) Added balancer parameter failontimeout to allow server admin
+ to configure an IO timeout as an error in the balancer.
+ [Daniel Ruggeri]
+
+ *) mod_auth_digest: Fix crashes if shm initialization failed. [Stefan
+ Fritsch]
+
+ *) htpasswd, htdbm: Fix password generation. PR 54735. [Stefan Fritsch]
+
+ *) core: Add workaround for gcc bug on sparc/64bit. PR 52900.
+ [Stefan Fritsch]
+
+ *) mod_setenvif: Fix crash in case SetEnvif and SetEnvIfExpr are used
+ together. PR 54881. [Ruediger Pluem]
+
+ *) htdigest: Fix buffer overflow when reading digest password file
+ with very long lines. PR 54893. [Rainer Jung]
+
+ *) ap_expr: Add the ability to base64 encode and base64 decode
+ strings and to generate their SHA1 and MD5 hash.
+ [Graham Leggett, Stefan Fritsch]
+
+ *) mod_log_config: Fix crash when logging request end time for a failed
+ request. PR 54828 [Rainer Jung]
+
+ *) mod_ssl: Catch missing, mismatched or encrypted client cert/key pairs
+ with SSLProxyMachineCertificateFile/Path directives. PR 52212, PR 54698.
+ [Keith Burdis <keith burdis.org>, Joe Orton, Kaspar Brand]
+
+ *) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits
+ in the error log to debug level. [William Rowe]
+
+ *) mod_cache_disk: CacheMinFileSize and CacheMaxFileSize were always
+ using compiled in defaults of 1000000/1 respectively. [Eric Covener]
+
+ *) mod_lbmethod_heartbeat, mod_heartmonitor: Respect DefaultRuntimeDir/
+ DEFAULT_REL_RUNTIMEDIR for the heartbeat storage file. [Jeff Trawick]
+
+ *) mod_include: Use new ap_expr for 'elif', like 'if',
+ if legacy parser is not specified. PR 54548 [Tom Donovan]
+
+ *) mod_lua: Add some new functions: r:htpassword(), r:mkdir(), r:mkrdir(),
+ r:rmdir(), r:touch(), r:get_direntries(), r.date_parse_rfc().
+ [Guenter Knauf]
+
+ *) mod_lua: Add multipart form data handling. [Daniel Gruno]
+
+ *) mod_lua: If a LuaMapHandler doesn't return any value, log a warning
+ and treat it as apache2.OK. [Eric Covener]
+
+ *) mod_lua: Add bindings for apr_dbd/mod_dbd database access
+ [Daniel Gruno]
+
+ *) mod_lua: Add LuaInputFilter/LuaOutputFilter for creating content
+ filters in Lua [Daniel Gruno]
+
+ *) mod_lua: Allow scripts handled by the lua-script handler to return
+ a status code to the client (such as a 302 or a 500) [Daniel Gruno]
+
+ *) mod_lua: Decline handling 'lua-script' if the file doesn't exist,
+ rather than throwing an internal server error. [Daniel Gruno]
+
+ *) mod_lua: Add functions r:flush and r:sendfile as well as additional
+ request information to the request_rec structure. [Daniel Gruno]
+
+ *) mod_lua: Add a server scope for Lua states, which creates a pool of
+ states with managable minimum and maximum size. [Daniel Gruno]
+
+ *) mod_lua: Add new directive, LuaMapHandler, for dynamically mapping
+ URIs to Lua scripts and functions using regular expressions.
+ [Daniel Gruno]
+
+ *) mod_lua: Add new directive LuaCodeCache for controlling in-memory
+ caching of lua scripts. [Daniel Gruno]
+
Changes with Apache 2.4.4
*) SECURITY: CVE-2012-3499 (cve.mitre.org)
@@ -13,20 +285,17 @@
*) mod_dir: Add support for the value 'disabled' in FallbackResource.
[Vincent Deffontaines]
-
+
*) mod_proxy_connect: Don't keepalive the connection to the client if the
backend closes the connection. PR 54474. [Pavel Mateja <pavel netsafe cz>]
*) mod_lua: Add bindings for mod_dbd/apr_dbd database access.
[Daniel Gruno]
-
+
*) mod_proxy: Allow for persistence of local changes made via the
balancer-manager between graceful/normal restarts and power
cycles. [Jim Jagielski]
- *) mod_status: Print out list of times since a Vhost was last used.
- [Jim Jagielski]
-
*) mod_proxy: Fix startup crash with mis-defined balancers.
PR 52402. [Jim Jagielski]
@@ -65,7 +334,7 @@
*) ab: Support socket timeout (-s timeout).
[Guido Serra <zeph fsfe org>]
-
+
*) httxt2dbm: Correct length computation for the 'value' stored in the
DBM file. PR 47650 [jon buckybox com]
@@ -76,7 +345,7 @@
at virtual host context or in Directory/Files/Location/If sections to
work properly in If sections that are not in a Directory/Files/Location.
[Stefan Fritsch]
-
+
*) mod_xml2enc: Fix problems with charset conversion altering the
Content-Length. [Micha Lenk <micha lenk info>]
@@ -527,7 +796,7 @@
*) SECURITY: CVE-2012-0031 (cve.mitre.org)
Fix scoreboard issue which could allow an unprivileged child process
- could cause the parent to crash at shutdown rather than terminate
+ to cause the parent to crash at shutdown rather than terminate
cleanly. [Joe Orton]
*) mod_ssl: Fix compilation with xlc on AIX. PR 52394. [Stefan Fritsch]
Added: release/httpd/CHANGES_2.4.6
==============================================================================
--- release/httpd/CHANGES_2.4.6 (added)
+++ release/httpd/CHANGES_2.4.6 Fri Jul 19 00:42:09 2013
@@ -0,0 +1,287 @@
+ -*- coding: utf-8 -*-
+
+Changes with Apache 2.4.6
+
+ *) Revert a broken fix for PR54948 that was applied to 2.4.5 (which was
+ not released) and found post-2.4.5 tagging.
+
+Changes with Apache 2.4.5
+
+ *) SECURITY: CVE-2013-1896 (cve.mitre.org)
+ mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with
+ the source href (sent as part of the request body as XML) pointing to a
+ URI that is not configured for DAV will trigger a segfault. [Ben Reser
+ <ben reser.org>]
+
+ *) SECURITY: CVE-2013-2249 (cve.mitre.org)
+ mod_session_dbd: Make sure that dirty flag is respected when saving
+ sessions, and ensure the session ID is changed each time the session
+ changes. This changes the format of the updatesession SQL statement.
+ Existing configurations must be changed.
+ [Takashi Sato <takashi tks.st>, Graham Leggett]
+
+ *) mod_auth_basic: Add a generic mechanism to fake basic authentication
+ using the ap_expr parser. AuthBasicFake allows the administrator to
+ construct their own username and password for basic authentication based
+ on their needs. [Graham Leggett]
+
+ *) mpm_event: Check that AsyncRequestWorkerFactor is not negative. PR 54254.
+ [Jackie Zhang <jackie qq zhang gmail com>]
+
+ *) mod_proxy: Ensure we don't attempt to amend a table we are iterating
+ through, ensuring that all headers listed by Connection are removed.
+ [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_proxy_http: Make the proxy-interim-response environment variable
+ effective by formally overriding origin server behaviour. [Graham
+ Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_proxy: Fix seg-faults when using the global pool on threaded
+ MPMs [Thomas Eckert <thomas.r.w.eckert gmail.com>, Graham Leggett,
+ Jim Jagielski]
+
+ *) mod_deflate: Remove assumptions as to when an EOS bucket might arrive.
+ Gracefully step aside if the body size is zero. [Graham Leggett]
+
+ *) mod_ssl: Fix possible truncation of OCSP responses when reading from the
+ server. [Joe Orton]
+
+ *) core: Support the SINGLE_LISTEN_UNSERIALIZED_ACCEPT optimization
+ on Linux kernel versions 3.x and above. PR 55121. [Bradley Heilbrun
+ <apache heilbrun.org>]
+
+ *) mod_cache_socache: Make sure the CacheSocacheMaxSize directive is merged
+ correctly. [Jens Låås <jelaas gmail.com>]
+
+ *) rotatelogs: add -n number-of-files option to roate through a number
+ of fixed-name logfiles. [Eric Covener]
+
+ *) mod_proxy: Support web-socket tunnels via mod_proxy_wstunnel.
+ [Jim Jagielski]
+
+ *) mod_cache_socache: Use the name of the socache implementation when performing
+ a lookup rather than using the raw arguments. [Martin Ksellmann
+ <ma...@ksellmann.de>]
+
+ *) core: Add dirwalk_stat hook. [Jeff Trawick]
+
+ *) core: Add post_perdir_config hook.
+ [Steinar Gunderson <sgunderson bigfoot.com>]
+
+ *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+ [Christophe Jaillet]
+
+ *) mod_remoteip: close file in error path. [Christophe Jaillet]
+
+ *) core: make the "default" parameter of the "ErrorDocument" option case
+ insensitive. PR 54419 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_proxy_html: make the "ProxyHTMLFixups" options case insensitive.
+ PR 54420 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_cache: Make option "CacheDisable" in mod_cache case insensitive.
+ PR 54462 [Tianyin Xu <tixu cs ucsd edu>]
+
+ *) mod_cache: If a 304 response indicates an entity not currently cached, then
+ the cache MUST disregard the response and repeat the request without the
+ conditional. [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: Ensure that we don't attempt to replace a cached response
+ with an older response as per RFC2616 13.12. [Graham Leggett, Co-Advisor
+ <coad measurement-factory.com>]
+
+ *) core, mod_cache: Ensure RFC2616 compliance in ap_meets_conditions()
+ with weak validation combined with If-Range and Range headers. Break
+ out explicit conditional header checks to be useable elsewhere in the
+ server. Ensure weak validation RFC compliance in the byteranges filter.
+ Ensure RFC validation compliance when serving cached entities. PR 16142
+ [Graham Leggett, Co-Advisor <coad measurement-factory.com>]
+
+ *) core: Add the ability to do explicit matching on weak and strong ETags
+ as per RFC2616 Section 13.3.3. [Graham Leggett, Co-Advisor
+ <coad measurement-factory.com>]
+
+ *) mod_cache: Ensure that updated responses to HEAD requests don't get
+ mistakenly paired with a previously cached body. Ensure that any existing
+ body is removed when a HEAD request is cached. [Graham Leggett,
+ Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: Honour Cache-Control: no-store in a request. [Graham Leggett]
+
+ *) mod_cache: Make sure that contradictory entity headers present in a 304
+ Not Modified response are caught and cause the entity to be removed.
+ [Graham Leggett]
+
+ *) mod_cache: Make sure Vary processing handles multivalued Vary headers and
+ multivalued headers referred to via Vary. [Graham Leggett]
+
+ *) mod_cache: When serving from cache, only the last header of a multivalued
+ header was taken into account. Fixed. Ensure that Warning headers are
+ correctly handled as per RFC2616. [Graham Leggett]
+
+ *) mod_cache: Ignore response headers specified by no-cache=header and
+ private=header as specified by RFC2616 14.9.1 What is Cacheable. Ensure
+ that these headers are still processed when multiple Cache-Control
+ headers are present in the response. PR 54706 [Graham Leggett,
+ Yann Ylavic <ylavic.dev gmail.com>]
+
+ *) mod_cache: Invalidate cached entities in response to RFC2616 Section
+ 13.10 Invalidation After Updates or Deletions. PR 15868 [Graham
+ Leggett]
+
+ *) mod_dav: Improve error handling in dav_method_put(), add new
+ dav_join_error() function. PR 54145. [Ben Reser <ben reser.org>]
+
+ *) mod_dav: Do not fail PROPPATCH when prop namespace is not known.
+ PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>]
+
+ *) mod_dav: When a PROPPATCH attempts to remove a non-existent dead
+ property on a resource for which there is no dead property in the same
+ namespace httpd segfaults. PR 52559 [Diego Santa Cruz
+ <diego.santaCruz spinetix.com>]
+
+ *) mod_dav: Sending an If or If-Match header with an invalid ETag doesn't
+ result in a 412 Precondition Failed for a COPY operation. PR54610
+ [Timothy Wood <tjw omnigroup.com>]
+
+ *) mod_dav: Make sure that when we prepare an If URL for Etag comparison,
+ we compare unencoded paths. PR 53910 [Timothy Wood <tjw omnigroup.com>]
+
+ *) 'AuthGroupFile' and 'AuthUserFile' do not accept anymore the optional
+ 'standard' keyword . It was unused and not documented.
+ PR54463 [Tianyin Xu <tixu cs.ucsd.edu> and Christophe Jaillet]
+
+ *) core: Do not over allocate memory within 'ap_rgetline_core' for
+ the common case. [Christophe Jaillet]
+
+ *) core: speed up (for common cases) and reduce memory usage of
+ ap_escape_logitem(). This should save 70-100 bytes in the request
+ pool for a default config. [Christophe Jaillet]
+
+ *) mod_dav: Ensure URI is correctly uriencoded on return. PR 54611
+ [Timothy Wood <tjw omnigroup.com>]
+
+ *) mod_proxy: Reject invalid values for Max-Forwards. [Graham Leggett,
+ Co-Advisor <coad measurement-factory.com>]
+
+ *) mod_cache: RFC2616 14.9.3 The s-maxage directive also implies the
+ semantics of the proxy-revalidate directive. [Graham Leggett]
+
+ *) mod_ssl: add support for subjectAltName-based host name checking
+ in proxy mode (SSLProxyCheckPeerName). PR 54030. [Kaspar Brand]
+
+ *) core: Use the proper macro for HTTP/1.1. [Graham Leggett]
+
+ *) event MPM: Provide error handling for ThreadStackSize. PR 54311
+ [Tianyin Xu <tixu cs.ucsd.edu>, Christophe Jaillet]
+
+ *) mod_dav: Do not segfault on PROPFIND with a zero length DBM.
+ PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>]
+
+ *) core: Improve error message where client's request-line exceeds
+ LimitRequestLine. PR 54384 [Christophe Jaillet]
+
+ *) mod_macro: New module that provides macros within configuration files.
+ [Fabien Coelho]
+
+ *) mod_cache_socache: New cache implementation backed by mod_socache
+ that replaces mod_mem_cache known from httpd 2.2. [Graham
+ Leggett]
+
+ *) htpasswd: Add -v option to verify a password. [Stefan Fritsch]
+
+ *) mod_proxy: Add BalancerInherit and ProxyPassInherit to control
+ whether Proxy Balancers and Workers are inherited by vhosts
+ (default is On). [Jim Jagielski]
+
+ *) mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind
+ password. [Daniel Ruggeri]
+
+ *) Added balancer parameter failontimeout to allow server admin
+ to configure an IO timeout as an error in the balancer.
+ [Daniel Ruggeri]
+
+ *) mod_auth_digest: Fix crashes if shm initialization failed. [Stefan
+ Fritsch]
+
+ *) htpasswd, htdbm: Fix password generation. PR 54735. [Stefan Fritsch]
+
+ *) core: Add workaround for gcc bug on sparc/64bit. PR 52900.
+ [Stefan Fritsch]
+
+ *) mod_setenvif: Fix crash in case SetEnvif and SetEnvIfExpr are used
+ together. PR 54881. [Ruediger Pluem]
+
+ *) htdigest: Fix buffer overflow when reading digest password file
+ with very long lines. PR 54893. [Rainer Jung]
+
+ *) ap_expr: Add the ability to base64 encode and base64 decode
+ strings and to generate their SHA1 and MD5 hash.
+ [Graham Leggett, Stefan Fritsch]
+
+ *) mod_log_config: Fix crash when logging request end time for a failed
+ request. PR 54828 [Rainer Jung]
+
+ *) mod_ssl: Catch missing, mismatched or encrypted client cert/key pairs
+ with SSLProxyMachineCertificateFile/Path directives. PR 52212, PR 54698.
+ [Keith Burdis <keith burdis.org>, Joe Orton, Kaspar Brand]
+
+ *) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits
+ in the error log to debug level. [William Rowe]
+
+ *) mod_cache_disk: CacheMinFileSize and CacheMaxFileSize were always
+ using compiled in defaults of 1000000/1 respectively. [Eric Covener]
+
+ *) mod_lbmethod_heartbeat, mod_heartmonitor: Respect DefaultRuntimeDir/
+ DEFAULT_REL_RUNTIMEDIR for the heartbeat storage file. [Jeff Trawick]
+
+ *) mod_include: Use new ap_expr for 'elif', like 'if',
+ if legacy parser is not specified. PR 54548 [Tom Donovan]
+
+ *) mod_lua: Add some new functions: r:htpassword(), r:mkdir(), r:mkrdir(),
+ r:rmdir(), r:touch(), r:get_direntries(), r.date_parse_rfc().
+ [Guenter Knauf]
+
+ *) mod_lua: Add multipart form data handling. [Daniel Gruno]
+
+ *) mod_lua: If a LuaMapHandler doesn't return any value, log a warning
+ and treat it as apache2.OK. [Eric Covener]
+
+ *) mod_lua: Add bindings for apr_dbd/mod_dbd database access
+ [Daniel Gruno]
+
+ *) mod_lua: Add LuaInputFilter/LuaOutputFilter for creating content
+ filters in Lua [Daniel Gruno]
+
+ *) mod_lua: Allow scripts handled by the lua-script handler to return
+ a status code to the client (such as a 302 or a 500) [Daniel Gruno]
+
+ *) mod_lua: Decline handling 'lua-script' if the file doesn't exist,
+ rather than throwing an internal server error. [Daniel Gruno]
+
+ *) mod_lua: Add functions r:flush and r:sendfile as well as additional
+ request information to the request_rec structure. [Daniel Gruno]
+
+ *) mod_lua: Add a server scope for Lua states, which creates a pool of
+ states with managable minimum and maximum size. [Daniel Gruno]
+
+ *) mod_lua: Add new directive, LuaMapHandler, for dynamically mapping
+ URIs to Lua scripts and functions using regular expressions.
+ [Daniel Gruno]
+
+ *) mod_lua: Add new directive LuaCodeCache for controlling in-memory
+ caching of lua scripts. [Daniel Gruno]
+
+
+
+ [Apache 2.3.0-dev includes those bug fixes and changes with the
+ Apache 2.2.xx tree as documented, and except as noted, below.]
+
+Changes with Apache 2.2.x and later:
+
+ *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup
+
+Changes with Apache 2.0.x and later:
+
+ *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/CHANGES?view=markup
+
Added: release/httpd/httpd-2.4.6-deps.tar.bz2
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6-deps.tar.bz2
------------------------------------------------------------------------------
svn:mime-type = application/x-bzip2
Added: release/httpd/httpd-2.4.6-deps.tar.bz2.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6-deps.tar.bz2.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd-2.4.6-deps.tar.bz2.md5
==============================================================================
--- release/httpd/httpd-2.4.6-deps.tar.bz2.md5 (added)
+++ release/httpd/httpd-2.4.6-deps.tar.bz2.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+a9ffc734a4aae25f0370406659be2c9f *httpd-2.4.6-deps.tar.bz2
Added: release/httpd/httpd-2.4.6-deps.tar.bz2.sha1
==============================================================================
--- release/httpd/httpd-2.4.6-deps.tar.bz2.sha1 (added)
+++ release/httpd/httpd-2.4.6-deps.tar.bz2.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+d475c130499beffa4afa4284f816d968955619fd *httpd-2.4.6-deps.tar.bz2
Added: release/httpd/httpd-2.4.6-deps.tar.gz
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6-deps.tar.gz
------------------------------------------------------------------------------
svn:mime-type = application/x-gzip
Added: release/httpd/httpd-2.4.6-deps.tar.gz.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6-deps.tar.gz.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd-2.4.6-deps.tar.gz.md5
==============================================================================
--- release/httpd/httpd-2.4.6-deps.tar.gz.md5 (added)
+++ release/httpd/httpd-2.4.6-deps.tar.gz.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+1ef19e7317069055ac2dc1a152644183 *httpd-2.4.6-deps.tar.gz
Added: release/httpd/httpd-2.4.6-deps.tar.gz.sha1
==============================================================================
--- release/httpd/httpd-2.4.6-deps.tar.gz.sha1 (added)
+++ release/httpd/httpd-2.4.6-deps.tar.gz.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+88bcf49e4375a8bb680e1e38843e7be51a7932e3 *httpd-2.4.6-deps.tar.gz
Added: release/httpd/httpd-2.4.6.tar.bz2
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6.tar.bz2
------------------------------------------------------------------------------
svn:mime-type = application/x-bzip2
Added: release/httpd/httpd-2.4.6.tar.bz2.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6.tar.bz2.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd-2.4.6.tar.bz2.md5
==============================================================================
--- release/httpd/httpd-2.4.6.tar.bz2.md5 (added)
+++ release/httpd/httpd-2.4.6.tar.bz2.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+ea5e361ca37b8d7853404419dd502efe *httpd-2.4.6.tar.bz2
Added: release/httpd/httpd-2.4.6.tar.bz2.sha1
==============================================================================
--- release/httpd/httpd-2.4.6.tar.bz2.sha1 (added)
+++ release/httpd/httpd-2.4.6.tar.bz2.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+16d8ec72535ded65d035122b0d944b0e64eaa2a2 *httpd-2.4.6.tar.bz2
Added: release/httpd/httpd-2.4.6.tar.gz
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6.tar.gz
------------------------------------------------------------------------------
svn:mime-type = application/x-gzip
Added: release/httpd/httpd-2.4.6.tar.gz.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd-2.4.6.tar.gz.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd-2.4.6.tar.gz.md5
==============================================================================
--- release/httpd/httpd-2.4.6.tar.gz.md5 (added)
+++ release/httpd/httpd-2.4.6.tar.gz.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+6c17dafd009ef8ffb5ccc9481d1e6441 *httpd-2.4.6.tar.gz
Added: release/httpd/httpd-2.4.6.tar.gz.sha1
==============================================================================
--- release/httpd/httpd-2.4.6.tar.gz.sha1 (added)
+++ release/httpd/httpd-2.4.6.tar.gz.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+ea85288d655239bf11d6b5d569b72b830071391c *httpd-2.4.6.tar.gz
Added: release/httpd/httpd_2.4.6-netware-bin.zip
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd_2.4.6-netware-bin.zip
------------------------------------------------------------------------------
svn:mime-type = application/zip
Added: release/httpd/httpd_2.4.6-netware-bin.zip.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd_2.4.6-netware-bin.zip.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd_2.4.6-netware-bin.zip.md5
==============================================================================
--- release/httpd/httpd_2.4.6-netware-bin.zip.md5 (added)
+++ release/httpd/httpd_2.4.6-netware-bin.zip.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+3453a3f74a566b24f50d02e38d43c5e7 *httpd_2.4.6-netware-bin.zip
Added: release/httpd/httpd_2.4.6-netware-bin.zip.sha1
==============================================================================
--- release/httpd/httpd_2.4.6-netware-bin.zip.sha1 (added)
+++ release/httpd/httpd_2.4.6-netware-bin.zip.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+980678a861cab17de17c2296faed1cf7f37ec770 *httpd_2.4.6-netware-bin.zip
Added: release/httpd/httpd_2.4.6-netware-sdk.zip
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd_2.4.6-netware-sdk.zip
------------------------------------------------------------------------------
svn:mime-type = application/zip
Added: release/httpd/httpd_2.4.6-netware-sdk.zip.asc
==============================================================================
Binary file - no diff available.
Propchange: release/httpd/httpd_2.4.6-netware-sdk.zip.asc
------------------------------------------------------------------------------
svn:mime-type = application/pgp-signature
Added: release/httpd/httpd_2.4.6-netware-sdk.zip.md5
==============================================================================
--- release/httpd/httpd_2.4.6-netware-sdk.zip.md5 (added)
+++ release/httpd/httpd_2.4.6-netware-sdk.zip.md5 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+c610d00ce9406f893055bc3f9512411e *httpd_2.4.6-netware-sdk.zip
Added: release/httpd/httpd_2.4.6-netware-sdk.zip.sha1
==============================================================================
--- release/httpd/httpd_2.4.6-netware-sdk.zip.sha1 (added)
+++ release/httpd/httpd_2.4.6-netware-sdk.zip.sha1 Fri Jul 19 00:42:09 2013
@@ -0,0 +1 @@
+e6b1bc4e5a36707824b71982e968ad6df115b537 *httpd_2.4.6-netware-sdk.zip