7532 lines
342 KiB
Plaintext
7532 lines
342 KiB
Plaintext
-------------------------------------------------------------------
|
||
Thu Aug 22 18:37:23 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
|
||
|
||
- Apply fix for CVE-2024-39884, bsc#1227353.
|
||
Patch file added:
|
||
* apache2-CVE-2024-39884.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 14 14:56:03 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
|
||
|
||
- Apply fix for CVE-2024-38474, bsc#1227278.
|
||
Patch file added:
|
||
* apache2-CVE-2024-38474.patch
|
||
- Apply fix for CVE-2024-38473, bsc#1227276.
|
||
Patch files added:
|
||
* apache2-CVE-2024-38473-1.patch
|
||
* apache2-CVE-2024-38473-2.patch
|
||
* apache2-CVE-2024-38473-3.patch
|
||
* apache2-CVE-2024-38473-4.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 8 10:53:20 UTC 2024 - David Anes <david.anes@suse.com>
|
||
|
||
- Security fix:
|
||
- CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
|
||
* Added apache2-CVE-2024-39573.patch
|
||
- CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
|
||
* Added apache2-CVE-2024-38477.patch
|
||
- CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
|
||
* Added apache2-CVE-2024-38475-1.patch
|
||
* Added apache2-CVE-2024-38475-2.patch
|
||
* Added apache2-CVE-2024-38475-3.patch
|
||
- CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
|
||
backend application output to run local handlers via internal
|
||
redirect
|
||
* Added apache2-CVE-2024-38476-1.patch
|
||
* Added apache2-CVE-2024-38476-2.patch
|
||
* Added apache2-CVE-2024-38476-3.patch
|
||
* Added apache2-CVE-2024-38476-4.patch
|
||
* Added apache2-CVE-2024-38476-5.patch
|
||
* Added apache2-CVE-2024-38476-6.patch
|
||
* Added apache2-CVE-2024-38476-7.patch
|
||
* Added apache2-CVE-2024-38476-8.patch
|
||
* Added apache2-CVE-2024-38476-9.patch
|
||
* Added apache2-CVE-2024-38476-10.patch
|
||
* Added apache2-CVE-2024-38476-11.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jun 13 16:50:39 UTC 2024 - pgajdos@suse.com
|
||
|
||
- added patches [bsc#1226217]
|
||
https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
|
||
+ apache2-issue-444.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Apr 30 13:44:03 UTC 2024 - pgajdos@suse.com
|
||
|
||
- security update
|
||
- added patches
|
||
fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
|
||
+ apache2-CVE-2023-38709.patch
|
||
fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
|
||
+ apache2-CVE-2024-24795.patch
|
||
fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
|
||
+ apache2-CVE-2024-27316.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 19 14:23:08 UTC 2023 - David Anes <david.anes@suse.com>
|
||
|
||
- Update to 2.4.58:
|
||
*) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
|
||
memory not reclaimed right away on RST (cve.mitre.org)
|
||
When a HTTP/2 stream was reset (RST frame) by a client, there
|
||
was a time window were the request's memory resources were not
|
||
reclaimed immediately. Instead, de-allocation was deferred to
|
||
connection close. A client could send new requests and resets,
|
||
keeping the connection busy and open and causing the memory
|
||
footprint to keep on growing. On connection close, all resources
|
||
were reclaimed, but the process might run out of memory before
|
||
that.
|
||
This was found by the reporter during testing of CVE-2023-44487
|
||
(HTTP/2 Rapid Reset Exploit) with their own test client. During
|
||
"normal" HTTP/2 use, the probability to hit this bug is very
|
||
low. The kept memory would not become noticeable before the
|
||
connection closes or times out.
|
||
Users are recommended to upgrade to version 2.4.58, which fixes
|
||
the issue.
|
||
Credits: Will Dormann of Vul Labs
|
||
|
||
*) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
|
||
initial windows size 0 (cve.mitre.org)
|
||
An attacker, opening a HTTP/2 connection with an initial window
|
||
size of 0, was able to block handling of that connection
|
||
indefinitely in Apache HTTP Server. This could be used to
|
||
exhaust worker resources in the server, similar to the well
|
||
known "slow loris" attack pattern.
|
||
This has been fixed in version 2.4.58, so that such connection
|
||
are terminated properly after the configured connection timeout.
|
||
This issue affects Apache HTTP Server: from 2.4.55 through
|
||
2.4.57.
|
||
Users are recommended to upgrade to version 2.4.58, which fixes
|
||
the issue.
|
||
Credits: Prof. Sven Dietrich (City University of New York)
|
||
|
||
*) SECURITY: CVE-2023-31122: mod_macro buffer over-read
|
||
(cve.mitre.org)
|
||
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
|
||
Server.This issue affects Apache HTTP Server: through 2.4.57.
|
||
Credits: David Shoon (github/davidshoon)
|
||
|
||
*) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
|
||
SSL routines::unexpected eof while reading" when using
|
||
OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
|
||
available. [Rainer Jung]
|
||
|
||
*) mod_http2: improved early cleanup of streams.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_proxy_http2: improved error handling on connection errors while
|
||
response is already underway.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_http2: fixed a bug that could lead to a crash in main connection
|
||
output handling. This occured only when the last request on a HTTP/2
|
||
connection had been processed and the session decided to shut down.
|
||
This could lead to an attempt to send a final GOAWAY while the previous
|
||
write was still in progress. See PR 66646.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
|
||
Fixes PR66752.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
|
||
described in RFC 8441. A new directive 'H2WebSockets on|off' has been
|
||
added. The feature is by default not enabled.
|
||
As also discussed in the manual, this feature should work for setups
|
||
using "ProxyPass backend-url upgrade=websocket" without further changes.
|
||
Special server modules for WebSockets will have to be adapted,
|
||
most likely, as the handling if IO events is different with HTTP/2.
|
||
HTTP/2 WebSockets are supported on platforms with native pipes. This
|
||
excludes Windows.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
|
||
in OCSP stapling. PR 66672. [Frank Meier <frank.meier ergon.ch>, covener]
|
||
|
||
*) mod_http2: fixed a bug in flushing pending data on an already closed
|
||
connection that could lead to a busy loop, preventing the HTTP/2 session
|
||
to close down successfully. Fixed PR 66624.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_http2: v2.0.15 with the following fixes and improvements
|
||
- New directive 'H2EarlyHint name value' to add headers to a response,
|
||
picked up already when a "103 Early Hints" response is sent. 'name' and
|
||
'value' must comply to the HTTP field restrictions.
|
||
This directive can be repeated several times and header fields of the
|
||
same names add. Sending a 'Link' header with 'preload' relation will
|
||
also cause a HTTP/2 PUSH if enabled and supported by the client.
|
||
- Fixed an issue where requests were not logged and accounted in a timely
|
||
fashion when the connection returns to "keepalive" handling, e.g. when
|
||
the request served was the last outstanding one.
|
||
This led to late appearance in access logs with wrong duration times
|
||
reported.
|
||
- Accurately report the bytes sent for a request in the '%O' Log format.
|
||
This addresses #203, a long outstanding issue where mod_h2 has reported
|
||
numbers over-eagerly from internal buffering and not what has actually
|
||
been placed on the connection.
|
||
The numbers are now the same with and without H2CopyFiles enabled.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_proxy_http2: fix retry handling to not leak temporary errors.
|
||
On detecting that that an existing connection was shutdown by the other
|
||
side, a 503 response leaked even though the request was retried on a
|
||
fresh connection.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_rewrite: Add server directory to include path as mod_rewrite requires
|
||
test_char.h. PR 66571 [Valeria Petrov <valeria.petrov@spinetix.com>]
|
||
|
||
*) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
|
||
of HTTP/2 requests in a forward proxy configuration.
|
||
General forward proxying is enabled via `ProxyRequests`. If the
|
||
HTTP/2 protocol is also enabled for such a server/host, this new
|
||
directive is needed in addition.
|
||
[Stefan Eissing]
|
||
|
||
*) core: Updated conf/mime.types:
|
||
- .js moved from 'application/javascript' to 'text/javascript'
|
||
- .mjs was added as 'text/javascript'
|
||
- add .opus ('audio/ogg')
|
||
- add 'application/vnd.geogebra.slides'
|
||
- add WebAssembly MIME types and extension
|
||
[Mathias Bynens <@mathiasbynens> via PR 318,
|
||
Richard de Boer <richard tubul.net>, Dave Hodder <dmh dmh.org.uk>,
|
||
Zbynek Konecny <zbynek1729 gmail.com>]
|
||
|
||
*) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
|
||
connection when sending data on the frontend one. This caused crashes
|
||
or infinite loops in rare situations.
|
||
*) mod_proxy_http2: fixed a bug in retry/response handling that could lead
|
||
to wrong status codes or HTTP messages send at the end of response bodies
|
||
exceeding the announced content-length.
|
||
*) mod_proxy_http2: fix retry handling to not leak temporary errors.
|
||
On detecting that that an existing connection was shutdown by the other
|
||
side, a 503 response leaked even though the request was retried on a
|
||
fresh connection.
|
||
*) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
|
||
the wrong order when a bucket_beam was destroyed.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_http2: avoid double chunked-encoding on internal redirects.
|
||
PR 66597 [Yann Ylavic, Stefan Eissing]
|
||
|
||
*) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
|
||
HTTP/2 requests twice. Fixes PR 66801.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_ssl: Fix handling of Certificate Revoked messages
|
||
in OCSP stapling. PR 66626. [<gmoniker gmail.com>]
|
||
|
||
*) mod_http2: fixed a bug in handling of stream timeouts.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
|
||
Checking in configure for proper version installed. Code
|
||
fixes for changed clienthello member name.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_md:
|
||
- New directive `MDMatchNames all|servernames` to allow more control over how
|
||
MDomains are matched to VirtualHosts.
|
||
- New directive `MDChallengeDns01Version`. Setting this to `2` will provide
|
||
the command also with the challenge value on `teardown` invocation. In version
|
||
1, the default, only the `setup` invocation gets this parameter.
|
||
Refs #312. Thanks to @domrim for the idea.
|
||
- For Managed Domain in "manual" mode, the checks if all used ServerName and
|
||
ServerAlias are part of the MDomain now reports a warning instead of an error
|
||
(AH10040) when not all names are present.
|
||
- MDChallengeDns01 can now be configured for individual domains.
|
||
Using PR from Jérôme Billiras (@bilhackmac) and adding test case and fixing proper working
|
||
- Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
|
||
teardown not being invoked as it should.
|
||
|
||
*) mod_ldap: Avoid performance overhead of APR-util rebind cache for
|
||
OpenLDAP 2.2+. PR 64414. [Joe Orton]
|
||
|
||
*) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
|
||
amount of response body bytes put into a single HTTP/2 DATA frame.
|
||
Setting this to 0 places no limit (but the max size allowed by the
|
||
protocol is observed).
|
||
The module, by default, tries to use the maximum size possible, which is
|
||
somewhat around 16KB. This sets the maximum. When less response data is
|
||
available, smaller frames will be sent.
|
||
|
||
*) mod_md: fixed passing of the server environment variables to programs
|
||
started via MDMessageCmd and MDChallengeDns01 on *nix system.
|
||
See <https://github.com/icing/mod_md/issues/319>.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_dav: Add DavBasePath directive to configure the repository root
|
||
path. PR 35077. [Joe Orton]
|
||
|
||
*) mod_alias: Add AliasPreservePath directive to map the full
|
||
path after the alias in a location. [Graham Leggett]
|
||
|
||
*) mod_alias: Add RedirectRelative to allow relative redirect targets to be
|
||
issued as-is. [Eric Covener, Graham Leggett]
|
||
|
||
*) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
|
||
sure that if the format is configured early enough it applies to every log
|
||
line. PR 62161. [Yann Ylavic]
|
||
|
||
*) mod_deflate: Add DeflateAlterETag to control how the ETag
|
||
is modified. The 'NoChange' parameter mimics 2.2.x behavior.
|
||
PR 45023, PR 39727. [Eric Covener]
|
||
|
||
*) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
|
||
|
||
*) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
|
||
Resolve inconsistency between the previous two occurrences by
|
||
counting workers in state SERVER_GRACEFUL no longer as busy,
|
||
but instead in a new counter "GracefulWorkers" (or on HTML
|
||
view as "workers gracefully restarting"). Also add the graceful
|
||
counter as a new column to the existing HTML per process table
|
||
for async MPMs. PR 63300. [Rainer Jung]
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Aug 5 11:44:23 UTC 2023 - Dirk Stoecker <opensuse@dstoecker.de>
|
||
|
||
- Enable building of mod_md
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 7 13:17:47 UTC 2023 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- Update to 2.4.57:
|
||
*) mod_proxy: Check before forwarding that a nocanon path has not been
|
||
rewritten with spaces during processing. [Yann Ylavic]
|
||
|
||
*) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
|
||
double encode encoded slashes in the URL sent by the reverse proxy to the
|
||
backend. [Ruediger Pluem]
|
||
|
||
*) mod_http2: fixed a crash during connection termination. See PR 66539.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
|
||
in a question mark. PR66547. [Eric Covener]
|
||
|
||
*) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
|
||
characters on redirections without the "NE" flag.
|
||
[Yann Ylavic, Eric Covener]
|
||
|
||
*) mod_proxy: Fix double encoding of the uri-path of the request forwarded
|
||
to the origin server, when using mapping=encoded|servlet. [Yann Ylavic]
|
||
|
||
*) mod_mime: Do not match the extention against possible query string
|
||
parameters in case ProxyPass was used with the nocanon option.
|
||
[Ruediger Pluem]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Mar 8 19:44:32 UTC 2023 - David Anes <david.anes@suse.com>
|
||
|
||
- This update fixes the following security issues:
|
||
* CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
|
||
* CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
|
||
|
||
- Update to 2.4.56:
|
||
*) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
|
||
truncated without the initial logfile being truncated. [Eric Covener]
|
||
*) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
|
||
allow connections of any age to be reused. Up to now, a negative value
|
||
was handled as an error when parsing the configuration file. PR 66421.
|
||
[nailyk <bzapache nailyk.fr>, Christophe Jaillet]
|
||
*) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
|
||
of headers. [Ruediger Pluem]
|
||
*) mod_md:
|
||
- Enabling ED25519 support and certificate transparency information when
|
||
building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
|
||
- MDChallengeDns01 can now be configured for individual domains.
|
||
Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
|
||
- Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
|
||
teardown not being invoked as it should.
|
||
[Stefan Eissing]
|
||
*) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
|
||
reported in access logs and error documents. The processing of the
|
||
reset was correct, only unneccesary reporting was caused.
|
||
[Stefan Eissing]
|
||
*) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
|
||
[Yann Ylavic]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 18 21:54:41 UTC 2023 - David Anes <david.anes@suse.com>
|
||
|
||
- This update fixes the following security issues:
|
||
* CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
|
||
* CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
|
||
* CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
|
||
|
||
- Update to 2.4.55:
|
||
*) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
|
||
2.4.55 allows a backend to trigger HTTP response splitting
|
||
(cve.mitre.org)
|
||
Prior to Apache HTTP Server 2.4.55, a malicious backend can
|
||
cause the response headers to be truncated early, resulting in
|
||
some headers being incorporated into the response body. If the
|
||
later headers have any security purpose, they will not be
|
||
interpreted by the client.
|
||
Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
|
||
|
||
*) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
|
||
Possible request smuggling (cve.mitre.org)
|
||
Inconsistent Interpretation of HTTP Requests ('HTTP Request
|
||
Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
|
||
allows an attacker to smuggle requests to the AJP server it
|
||
forwards requests to. This issue affects Apache HTTP Server
|
||
Apache HTTP Server 2.4 version 2.4.54 and prior versions.
|
||
Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
|
||
at Qi'anxin Group
|
||
|
||
*) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write
|
||
of zero byte (cve.mitre.org)
|
||
A carefully crafted If: request header can cause a memory read,
|
||
or write of a single zero byte, in a pool (heap) memory location
|
||
beyond the header value sent. This could cause the process to
|
||
crash.
|
||
This issue affects Apache HTTP Server 2.4.54 and earlier.
|
||
|
||
*) mod_dav: Open the lock database read-only when possible.
|
||
PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu]
|
||
|
||
*) mod_proxy_http2: apply the standard httpd content type handling
|
||
to responses from the backend, as other proxy modules do. Fixes PR 66391.
|
||
Thanks to Jérôme Billiras for providing the patch.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
|
||
[Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez
|
||
<alejandro.alvarez.ayllon cern.ch>]
|
||
|
||
*) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic]
|
||
|
||
*) mod_http2: version 2.0.10 of the module, synchronizing changes
|
||
with the gitgub version. This is a partial rewrite of how connections
|
||
and streams are handled.
|
||
- an APR pollset and pipes (where supported) are used to monitor
|
||
the main connection and react to IO for request/response handling.
|
||
This replaces the stuttered timed waits of earlier versions.
|
||
- H2SerializeHeaders directive still exists, but has no longer an effect.
|
||
- Clients that seemingly misbehave still get less resources allocated,
|
||
but ongoing requests are no longer disrupted.
|
||
- Fixed an issue since 1.15.24 that "Server" headers in proxied requests
|
||
were overwritten instead of preserved. [PR by @daum3ns]
|
||
- A regression in v1.15.24 was fixed that could lead to httpd child
|
||
processes not being terminated on a graceful reload or when reaching
|
||
MaxConnectionsPerChild. When unprocessed h2 requests were queued at
|
||
the time, these could stall. See #212.
|
||
- Improved information displayed in 'server-status' for H2 connections when
|
||
Extended Status is enabled. Now one can see the last request that IO
|
||
operations happened on and transferred IO stats are updated as well.
|
||
- When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
|
||
send a GOAWAY frame much too early on new connections, leading to invalid
|
||
protocol state and a client failing the request. See PR65731 at
|
||
<https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>.
|
||
The module now initializes the HTTP/2 protocol correctly and allows the
|
||
client to submit one request before the shutdown via a GOAWAY frame
|
||
is being announced.
|
||
- :scheme pseudo-header values, not matching the
|
||
connection scheme, are forwarded via absolute uris to the
|
||
http protocol processing to preserve semantics of the request.
|
||
Checks on combinations of pseudo-headers values/absence
|
||
have been added as described in RFC 7540. Fixes #230.
|
||
- A bug that prevented trailers (e.g. HEADER frame at the end) to be
|
||
generated in certain cases was fixed. See #233 where it prevented
|
||
gRPC responses to be properly generated.
|
||
- Request and response header values are automatically stripped of leading
|
||
and trialing space/tab characters. This is equivalent behaviour to what
|
||
Apache httpd's http/1.1 parser does.
|
||
The checks for this in nghttp2 v1.50.0+ are disabled.
|
||
- Extensive testing in production done by Alessandro Bianchi (@alexskynet)
|
||
on the v2.0.x versions for stability. Many thanks!
|
||
*) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
|
||
request ':authority' is known. Improved test case that did not catch that
|
||
the previous 'fix' was incorrect.
|
||
|
||
*) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
|
||
using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
|
||
|
||
*) mod_proxy: The AH03408 warning for a forcibly closed backend
|
||
connection is now logged at INFO level. [Yann Ylavic]
|
||
|
||
*) mod_ssl: When dumping the configuration, the existence of
|
||
certificate/key files is no longer tested. [Joe Orton]
|
||
|
||
*) mod_authn_core: Add expression support to AuthName and AuthType.
|
||
[Graham Leggett]
|
||
|
||
*) mod_ssl: when a proxy connection had handled a request using SSL, an
|
||
error was logged when "SSLProxyEngine" was only configured in the
|
||
location/proxy section and not the overall server. The connection
|
||
continued to work, the error log was in error. Fixed PR66190.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
|
||
[Alessandro Cavaliere <alessandro.cavalier7 unibo.it>]
|
||
|
||
*) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
|
||
[Alessandro Cavaliere <alessandro.cavalier7 unibo.it>]
|
||
|
||
*) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
|
||
|
||
*) mod_md: a new directive `MDStoreLocks` can be used on cluster
|
||
setups with a shared file system for `MDStoreDir` to order
|
||
activation of renewed certificates when several cluster nodes are
|
||
restarted at the same time. Store locks are not enabled by default.
|
||
Restored curl_easy cleanup behaviour from v2.4.14 and refactored
|
||
the use of curl_multi for OCSP requests to work with that.
|
||
Fixes <https://github.com/icing/mod_md/issues/293>.
|
||
|
||
*) core: Avoid an overflow on large inputs in ap_is_matchexp. PR 66033
|
||
[Ruediger Pluem]
|
||
|
||
*) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
|
||
storage instead of slotmem. Needed after setting
|
||
HeartbeatMaxServers default to the documented value 10 in 2.4.54.
|
||
PR 66131. [Jérôme Billiras]
|
||
|
||
*) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
|
||
This is a game changer for performances if client use PROPFIND a lot,
|
||
PR 66313. [Emmanuel Dreyfus]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 12 08:58:58 UTC 2022 - Dirk Müller <dmueller@suse.com>
|
||
|
||
- switch to pkgconfig(zlib) so that alternative providers can be
|
||
used
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 23 06:06:26 UTC 2022 - Stephan Kulow <coolo@suse.com>
|
||
|
||
- The 2.4.54 release brought support for PCRE2, but for that we also
|
||
need to change buildrequires to pcre2-devel
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 20 15:01:58 UTC 2022 - David Anes <david.anes@suse.com>
|
||
|
||
- Remove references to README.QUICKSTART and point them to
|
||
https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 1 06:31:31 UTC 2022 - Stefan Schubert <schubi@suse.com>
|
||
|
||
- Migration to /usr/etc: Saving user changed configuration files
|
||
in /etc and restoring them while an RPM update.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 28 14:39:26 UTC 2022 - Stefan Schubert <schubi@intern>
|
||
|
||
- Moved logrotate files from user specific directory /etc/logrotate.d
|
||
to vendor specific directory /usr/etc/logrotate.d.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 8 11:26:13 UTC 2022 - pgajdos@suse.com
|
||
|
||
- update httpd-framework to svn revision 1898917
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 8 10:06:34 UTC 2022 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.54
|
||
Changes with Apache 2.4.54
|
||
*) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
|
||
hop-by-hop mechanism (cve.mitre.org)
|
||
Apache HTTP Server 2.4.53 and earlier may not send the
|
||
X-Forwarded-* headers to the origin server based on client side
|
||
Connection header hop-by-hop mechanism.
|
||
This may be used to bypass IP based authentication on the origin
|
||
server/application.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Gaetan Ferry (Synacktiv) for reporting this issue
|
||
*) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
|
||
websockets (cve.mitre.org)
|
||
Apache HTTP Server 2.4.53 and earlier may return lengths to
|
||
applications calling r:wsread() that point past the end of the
|
||
storage allocated for the buffer.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Ronald Crane (Zippenhop LLC) for reporting this issue
|
||
*) SECURITY: CVE-2022-30522: mod_sed denial of service
|
||
(cve.mitre.org)
|
||
If Apache HTTP Server 2.4.53 is configured to do transformations
|
||
with mod_sed in contexts where the input to mod_sed may be very
|
||
large, mod_sed may make excessively large memory allocations and
|
||
trigger an abort.
|
||
Credits: This issue was found by Brian Moussalli from the JFrog
|
||
Security Research team
|
||
*) SECURITY: CVE-2022-29404: Denial of service in mod_lua
|
||
r:parsebody (cve.mitre.org)
|
||
In Apache HTTP Server 2.4.53 and earlier, a malicious request to
|
||
a lua script that calls r:parsebody(0) may cause a denial of
|
||
service due to no default limit on possible input size.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Ronald Crane (Zippenhop LLC) for reporting this issue
|
||
*) SECURITY: CVE-2022-28615: Read beyond bounds in
|
||
ap_strcmp_match() (cve.mitre.org)
|
||
Apache HTTP Server 2.4.53 and earlier may crash or disclose
|
||
information due to a read beyond bounds in ap_strcmp_match()
|
||
when provided with an extremely large input buffer. While no
|
||
code distributed with the server can be coerced into such a
|
||
call, third-party modules or lua scripts that use
|
||
ap_strcmp_match() may hypothetically be affected.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Ronald Crane (Zippenhop LLC) for reporting this issue
|
||
*) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
|
||
(cve.mitre.org)
|
||
The ap_rwrite() function in Apache HTTP Server 2.4.53 and
|
||
earlier may read unintended memory if an attacker can cause the
|
||
server to reflect very large input using ap_rwrite() or
|
||
ap_rputs(), such as with mod_luas r:puts() function.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Ronald Crane (Zippenhop LLC) for reporting this issue
|
||
*) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
|
||
(cve.mitre.org)
|
||
Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
|
||
bounds when configured to process requests with the mod_isapi
|
||
module.
|
||
Credits: The Apache HTTP Server project would like to thank
|
||
Ronald Crane (Zippenhop LLC) for reporting this issue
|
||
*) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
|
||
smuggling (cve.mitre.org)
|
||
Inconsistent Interpretation of HTTP Requests ('HTTP Request
|
||
Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
|
||
allows an attacker to smuggle requests to the AJP server it
|
||
forwards requests to. This issue affects Apache HTTP Server
|
||
Apache HTTP Server 2.4 version 2.4.53 and prior versions.
|
||
Credits: Ricter Z @ 360 Noah Lab
|
||
*) mod_ssl: SSLFIPS compatible with OpenSSL 3.0. PR 66063.
|
||
[Petr Sumbera <petr.sumbera oracle.com>, Yann Ylavic]
|
||
*) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
|
||
PR 65666. [Yann Ylavic]
|
||
*) mod_md: a bug was fixed that caused very large MDomains
|
||
with the combined DNS names exceeding ~7k to fail, as
|
||
request bodies would contain partially wrong data from
|
||
uninitialized memory. This would have appeared as failure
|
||
in signing-up/renewing such configurations.
|
||
[Stefan Eissing, Ronald Crane (Zippenhop LLC)]
|
||
*) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
|
||
PR 65666. [Yann Ylavic]
|
||
*) MPM event: Restart children processes killed before idle maintenance.
|
||
PR 65769. [Yann Ylavic, Ruediger Pluem]
|
||
*) ab: Allow for TLSv1.3 when the SSL library supports it.
|
||
[abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
|
||
*) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
|
||
transmission delays. PR 66019. [Yann Ylavic]
|
||
*) MPM event: Fix accounting of active/total processes on ungraceful restart,
|
||
PR 66004 (follow up to PR 65626 from 2.4.52). [Yann Ylavic]
|
||
*) core: make ap_escape_quotes() work correctly on strings
|
||
with more than MAX_INT/2 characters, counting quotes double.
|
||
Credit to <generalbugs@zippenhop.com> for finding this.
|
||
[Stefan Eissing]
|
||
*) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
|
||
an ACME CA. This gives a failover for renewals when several consecutive attempts
|
||
to get a certificate failed.
|
||
A new directive was added: `MDRetryDelay` sets the delay of retries.
|
||
A new directive was added: `MDRetryFailover` sets the number of errored
|
||
attempts before an alternate CA is selected for certificate renewals.
|
||
[Stefan Eissing]
|
||
*) mod_http2: remove unused and insecure code. Fixes PR66037.
|
||
Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
|
||
[Stefan Eissing]
|
||
*) mod_proxy: Add backend port to log messages to
|
||
ease identification of involved service. [Rainer Jung]
|
||
*) mod_http2: removing unscheduling of ongoing tasks when
|
||
connection shows potential abuse by a client. This proved
|
||
counter-productive and the abuse detection can false flag
|
||
requests using server-side-events.
|
||
Fixes <https://github.com/icing/mod_h2/issues/231>.
|
||
[Stefan Eissing]
|
||
*) mod_md: Implement full auto status ("key: value" type status output).
|
||
Especially not only status summary counts for certificates and
|
||
OCSP stapling but also lists. Auto status format is similar to
|
||
what was used for mod_proxy_balancer.
|
||
[Rainer Jung]
|
||
*) mod_md: fixed a bug leading to failed transfers for OCSP
|
||
stapling information when more than 6 certificates needed
|
||
updates in the same run. [Stefan Eissing]
|
||
*) mod_proxy: Set a status code of 502 in case the backend just closed the
|
||
connection in reply to our forwarded request. [Ruediger Pluem]
|
||
*) mod_md: a possible NULL pointer deref was fixed in
|
||
the JSON code for persisting time periods (start+end).
|
||
Fixes #282 on mod_md's github.
|
||
Thanks to @marcstern for finding this. [Stefan Eissing]
|
||
*) mod_heartmonitor: Set the documented default value
|
||
"10" for HeartbeatMaxServers instead of "0". With "0"
|
||
no shared memory slotmem was initialized. [Rainer Jung]
|
||
*) mod_md: added support for managing certificates via a
|
||
local tailscale daemon for users of that secure networking.
|
||
This gives trusted certificates for tailscale assigned
|
||
domain names in the *.ts.net space.
|
||
[Stefan Eissing]
|
||
- modified patches
|
||
% apache-test-application-xml-type.patch (refreshed)
|
||
% apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
|
||
% apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 14 12:19:36 UTC 2022 - pgajdos@suse.com
|
||
|
||
- httpd-framework updated to svn1898917
|
||
- deleted patches
|
||
- apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
|
||
- apache2-perl-io-socket.patch (upstreamed)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 14 11:20:53 UTC 2022 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.53
|
||
*) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
|
||
(cve.mitre.org)
|
||
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
|
||
Server allows an attacker to overwrite heap memory with possibly
|
||
attacker provided data.
|
||
This issue affects Apache HTTP Server 2.4 version 2.4.52 and
|
||
prior versions.
|
||
Credits: Ronald Crane (Zippenhop LLC)
|
||
*) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
|
||
very large or unlimited LimitXMLRequestBody (cve.mitre.org)
|
||
If LimitXMLRequestBody is set to allow request bodies larger
|
||
than 350MB (defaults to 1M) on 32 bit systems an integer
|
||
overflow happens which later causes out of bounds writes.
|
||
This issue affects Apache HTTP Server 2.4.52 and earlier.
|
||
Credits: Anonymous working with Trend Micro Zero Day Initiative
|
||
*) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
|
||
in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
|
||
Apache HTTP Server 2.4.52 and earlier fails to close inbound
|
||
connection when errors are encountered discarding the request
|
||
body, exposing the server to HTTP Request Smuggling
|
||
Credits: James Kettle <james.kettle portswigger.net>
|
||
*) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
|
||
in r:parsebody (cve.mitre.org)
|
||
A carefully crafted request body can cause a read to a random
|
||
memory area which could cause the process to crash.
|
||
This issue affects Apache HTTP Server 2.4.52 and earlier.
|
||
Credits: Chamal De Silva
|
||
*) core: Make sure and check that LimitXMLRequestBody fits in system memory.
|
||
[Ruediger Pluem, Yann Ylavic]
|
||
*) core: Simpler connection close logic if discarding the request body fails.
|
||
[Yann Ylavic, Ruediger Pluem]
|
||
*) mod_http2: preserve the port number given in a HTTP/1.1
|
||
request that was Upgraded to HTTP/2. Fixes PR65881.
|
||
[Stefan Eissing]
|
||
*) mod_proxy: Allow for larger worker name. PR 53218. [Yann Ylavic]
|
||
*) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
|
||
an attempt to load a dbm driver fails, log clearly which driver triggered
|
||
the error (not "default"), and what the error was. [Graham Leggett]
|
||
*) mod_proxy: Use the maxium of front end and backend timeouts instead of the
|
||
minimum when tunneling requests (websockets, CONNECT requests).
|
||
Backend timeouts can be configured more selectively (per worker if needed)
|
||
as front end timeouts and typically the backend timeouts reflect the
|
||
application requirements better. PR 65886 [Ruediger Pluem]
|
||
*) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
|
||
when an efficient TLS implementation is available. [Yann Ylavic]
|
||
*) core, mod_info: Add compiled and loaded PCRE versions to version
|
||
number display. [Rainer Jung]
|
||
*) mod_md: do not interfere with requests to /.well-known/acme-challenge/
|
||
resources if challenge type 'http-01' is not configured for a domain.
|
||
Fixes <https://github.com/icing/mod_md/issues/279>.
|
||
[Stefan Eissing]
|
||
*) mod_dav: Fix regression when gathering properties which could lead to huge
|
||
memory consumption proportional to the number of resources.
|
||
[Evgeny Kotkov, Ruediger Pluem]
|
||
*) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
|
||
for regular expression evaluation. This depends on locating pcre2-config.
|
||
[William Rowe, Petr Pisar <ppisar redhat.com>, Rainer Jung]
|
||
*) Add the ldap function to the expression API, allowing LDAP filters and
|
||
distinguished names based on expressions to be escaped correctly to
|
||
guard against LDAP injection. [Graham Leggett]
|
||
*) mod_md: the status description in MDomain's JSON, exposed in the
|
||
md-status handler (if configured) did sometimes not carry the correct
|
||
message when certificates needed renew.
|
||
[Stefan Eissing]
|
||
*) mpm_event: Fix a possible listener deadlock on heavy load when restarting
|
||
and/or reaching MaxConnectionsPerChild. PR 65769. [Yann Ylavic]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jan 27 13:57:47 UTC 2022 - pgajdos@suse.com
|
||
|
||
- ssl-global.conf: set SSLCipherSuite to PROFILE=SYSTEM instead of
|
||
DEFAULT_SUSE [jsc#SLE-22561]
|
||
- set also SSLProxyCipherSuite to PROFILE=SYSTEM
|
||
- modified sources
|
||
% apache2-ssl-global.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 11 12:05:55 UTC 2022 - David Anes <david.anes@suse.com>
|
||
|
||
- Align some defaults in apache2-server-tuning.conf to upstream
|
||
defaults:
|
||
* Updated MaxRequestWorkers and ServerLimit to 256. [bsc#1194062]
|
||
- The old name MaxRequestsPerChild is changed to MaxConnectionsPerChild.
|
||
* See https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 10 18:12:38 UTC 2022 - Dominique Leuenberger <dimstar@opensuse.org>
|
||
|
||
- Add apache2-perl-io-socket.patch: t/ssl/ocsp.t: Handle new error
|
||
message raised by IO-Socket-SSL 2.073.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 10 16:16:16 UTC 2022 - olaf@aepfle.de
|
||
|
||
- remove instance units from post scripts, they can not be reloaded
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 20 11:26:49 UTC 2021 - David Anes <david.anes@suse.com>
|
||
|
||
- version update to 2.4.52:
|
||
* fix CVE-2021-44224: NULL dereference or SSRF in forward proxy
|
||
configurations [boo#1193943]
|
||
* fix CVE-2021-44790: buffer overflow when parsing multipart
|
||
content in mod_lua [boo#1193942]
|
||
*) http: Enforce that fully qualified uri-paths not to be forward-proxied
|
||
have an http(s) scheme, and that the ones to be forward proxied have a
|
||
hostname, per HTTP specifications.
|
||
*) OpenSSL autoconf detection improvement: pick up openssl.pc in the
|
||
already sent it to the client.
|
||
*) mod_http: Correctly sent a 100 Continue status code when sending an interim
|
||
response as result of an Expect: 100-Continue in the request and not the
|
||
current status code of the request
|
||
*) mod_dav: Some DAV extensions, like CalDAV, specify both document
|
||
elements and property elements that need to be taken into account
|
||
when generating a property. The document element and property element
|
||
are made available in the dav_liveprop_elem structure by calling
|
||
dav_get_liveprop_element()
|
||
*) mod_dav: Add utility functions dav_validate_root_ns(),
|
||
dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() and
|
||
dav_find_attr() so that other modules get to play too.
|
||
*) mpm_event: Restart stopping of idle children after a load peak
|
||
*) mod_http2: fixes 2 regressions in server limit handling.
|
||
1. When reaching server limits, such as MaxRequestsPerChild, the
|
||
HTTP/2 connection send a GOAWAY frame much too early on new
|
||
connections, leading to invalid protocol state and a client
|
||
failing the request
|
||
The module now initializes the HTTP/2 protocol correctly and
|
||
allows the client to submit one request before the shutdown
|
||
via a GOAWAY frame is being announced.
|
||
2. A regression in v1.15.24 was fixed that could lead to httpd
|
||
child processes not being terminated on a graceful reload or
|
||
when reaching MaxConnectionsPerChild. When unprocessed h2
|
||
requests were queued at the time, these could stall.
|
||
See <https://github.com/icing/mod_h2/issues/212>.
|
||
*) mod_ssl: Add build support for OpenSSL v3
|
||
*) mod_proxy_connect: Honor the smallest of the backend or client timeout
|
||
while tunneling
|
||
*) mod_proxy: SetEnv proxy-nohalfclose (or alike) allows to disable TCP
|
||
half-close forwarding when tunneling protocols
|
||
*) core: Be safe with ap_lingering_close() called with a socket NULL-ed by
|
||
a third-party module. PR 65627.
|
||
*) mod_md: Fix memory leak in case of failures to load the private key.
|
||
*) mod_md: adding v2.4.8 with the following changes
|
||
- Added support for ACME External Account Binding (EAB).
|
||
Use the new directive `MDExternalAccountBinding` to provide the
|
||
server with the value for key identifier and hmac as provided by
|
||
your CA.
|
||
While working on some servers, EAB handling is not uniform
|
||
across CAs. First tests with a Sectigo Certificate Manager in
|
||
demo mode are successful. But ZeroSSL, for example, seems to
|
||
regard EAB values as a one-time-use-only thing, which makes them
|
||
fail if you create a seconde account or retry the creation of the
|
||
first account with the same EAB.
|
||
- The directive 'MDCertificateAuthority' now checks if its parameter
|
||
is a http/https url or one of a set of known names. Those are
|
||
'LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' and 'Buypass-Test'
|
||
for now and they are not case-sensitive.
|
||
The default of LetsEncrypt is unchanged.
|
||
- `MDContactEmail` can now be specified inside a `<MDomain dnsname>`
|
||
section.
|
||
- Treating 401 HTTP status codes for orders like 403, since some ACME
|
||
servers seem to prefer that for accessing oders from other accounts.
|
||
- When retrieving certificate chains, try to read the repsonse even
|
||
if the HTTP Content-Type is unrecognized.
|
||
- Fixed a bug that reset the error counter of a certificate renewal
|
||
and prevented the increasing delays in further attempts.
|
||
- Fixed the renewal process giving up every time on an already existing
|
||
order with some invalid domains. Now, if such are seen in a previous
|
||
order, a new order is created for a clean start over again.
|
||
See <https://github.com/icing/mod_md/issues/268>
|
||
- Fixed a mixup in md-status handler when static certificate files
|
||
and renewal was configured at the same time.
|
||
*) mod_md: values for External Account Binding (EAB) can
|
||
now also be configured to be read from a separate JSON
|
||
file. This allows to keep server configuration permissions
|
||
world readable without exposing secrets.
|
||
*) mod_proxy_uwsgi: Remove duplicate slashes at the beginning of PATH_INFO.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Nov 24 11:04:43 UTC 2021 - pgajdos@suse.com
|
||
|
||
- httpd-framework updated to svn1894461
|
||
- added patches
|
||
fix reverted logic, DirectorySlash NotFound is available in trunk only
|
||
+ apache-test-DirectorySlash-NotFound-logic.patch
|
||
- do not consider php tests, they do not run anyway
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Nov 14 10:21:09 UTC 2021 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- add section for the 'event' MPM to apache2-server-tuning.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 7 17:30:44 UTC 2021 - Michael Ströder <michael@stroeder.com>
|
||
|
||
- version update to 2.4.51
|
||
*) SECURITY: CVE-2021-42013: Path Traversal and Remote Code
|
||
Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete
|
||
fix of CVE-2021-41773) (cve.mitre.org)
|
||
*) core: Add ap_unescape_url_ex() for better decoding control, and deprecate
|
||
unused AP_NORMALIZE_DROP_PARAMETERS flag.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 4 15:23:51 UTC 2021 - Michael Ströder <michael@stroeder.com>
|
||
|
||
- version update to 2.4.50
|
||
*) core: AP_NORMALIZE_DECODE_UNRESERVED should normalize the second dot in
|
||
the uri-path when it's preceded by a dot. [Yann Ylavic]
|
||
*) mod_md: when MDMessageCmd for a 'challenge-setup:<type>:<dnsname>'
|
||
fails (!= 0 exit), the renewal process is aborted and an error is
|
||
reported for the MDomain. This provides scripts that distribute
|
||
information in a cluster to abort early with bothering an ACME
|
||
server to validate a dns name that will not work. The common
|
||
retry logic will make another attempt in the future, as with
|
||
other failures.
|
||
Fixed a bug when adding private key specs to an already working
|
||
MDomain, see <https://github.com/icing/mod_md/issues/260>.
|
||
[Stefan Eissing]
|
||
*) mod_proxy: Handle UDS URIs with empty hostname ("unix:///...") as if they
|
||
had no hostname ("unix:/..."). [Yann Ylavic]
|
||
*) mod_md: fixed a bug in handling multiple parallel OCSP requests. These could
|
||
run into an assertion which terminated (and restarted) the child process where
|
||
the task was running. Eventually, all OCSP responses were collected, but not
|
||
in the way that things are supposed to work.
|
||
See also <https://bz.apache.org/bugzilla/show_bug.cgi?id=65567>.
|
||
The bug was possibly triggered when more than one OCSP status needed updating
|
||
at the same time. For example for several renewed certificates after a server
|
||
reload.
|
||
*) mod_rewrite: Fix UDS ("unix:") scheme for [P] rules. PR 57691 + 65590.
|
||
[Janne Peltonen <janne.peltonen sange.fi>]
|
||
*) event mpm: Correctly count active child processes in parent process if
|
||
child process dies due to MaxConnectionsPerChild.
|
||
PR 65592 [Ruediger Pluem]
|
||
*) mod_http2: when a server is restarted gracefully, any idle h2 worker
|
||
threads are shut down immediately.
|
||
Also, change OpenSSL API use for deprecations in OpenSSL 3.0.
|
||
Adds all other, never proposed code changes to make a clean
|
||
sync of http2 sources. [Stefan Eissing]
|
||
*) mod_dav: Correctly handle errors returned by dav providers on REPORT
|
||
requests. [Ruediger Pluem]
|
||
*) core: do not install core input/output filters on secondary
|
||
connections. [Stefan Eissing]
|
||
*) core: Add ap_pre_connection() as a wrapper to ap_run_pre_connection()
|
||
and use it to prevent that failures in running the pre_connection
|
||
hook cause crashes afterwards. [Ruediger Pluem]
|
||
*) mod_speling: Add CheckBasenameMatch PR 44221. [Christophe Jaillet]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 17 08:37:29 UTC 2021 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.49
|
||
*) core/mod_proxy/mod_ssl:
|
||
Adding `outgoing` flag to conn_rec, indicating a connection is
|
||
initiated by the server to somewhere, in contrast to incoming
|
||
connections from clients.
|
||
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
|
||
as outgoing and is used by mod_proxy instead of the previous
|
||
optional function `ssl_engine_set`. This enables other SSL
|
||
module to secure proxy connections.
|
||
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
|
||
`ssl_proxy_enable` are now provided by the core to have backward
|
||
compatibility with non-httpd modules that might use them. mod_ssl
|
||
itself no longer registers these functions, but keeps them in its
|
||
header for backward compatibility.
|
||
The core provided optional function wrap any registered function
|
||
like it was done for `ssl_is_ssl`.
|
||
[Stefan Eissing]
|
||
*) mod_ssl: Support logging private key material for use with
|
||
wireshark via log file given by SSLKEYLOGFILE environment
|
||
variable. Requires OpenSSL 1.1.1. PR 63391. [Joe Orton]
|
||
*) mod_proxy: Do not canonicalize the proxied URL when both "nocanon" and
|
||
"ProxyPassInterpolateEnv On" are configured. PR 65549.
|
||
[Joel Self <joelself gmail.com>]
|
||
*) mpm_event: Fix children processes possibly not stopped on graceful
|
||
restart. PR 63169. [Joel Self <joelself gmail.com>]
|
||
*) mod_proxy: Fix a potential infinite loop when tunneling Upgrade(d)
|
||
protocols from mod_proxy_http, and a timeout triggering falsely when
|
||
using mod_proxy_wstunnel, mod_proxy_connect or mod_proxy_http with
|
||
upgrade= setting. PRs 65521 and 65519. [Yann Ylavic]
|
||
*) mod_unique_id: Reduce the time window where duplicates may be generated
|
||
PR 65159
|
||
[Christophe Jaillet]
|
||
*) mpm_prefork: Block signals for child_init hooks to prevent potential
|
||
threads created from there to catch MPM's signals.
|
||
[Ruediger Pluem, Yann Ylavic]
|
||
*) Revert "mod_unique_id: Fix potential duplicated ID generation under heavy load.
|
||
PR 65159" added in 2.4.47.
|
||
This causes issue on Windows.
|
||
[Christophe Jaillet]
|
||
*) mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker. [Yann Ylavic]
|
||
*) mod_md: Certificate/keys pairs are verified as matching before a renewal is accepted
|
||
as successful or a staged renewal is replacing the existing certificates.
|
||
This avoid potential mess ups in the md store file system to render the active
|
||
certificates non-working. [@mkauf]
|
||
*) mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
|
||
[Yann Ylavic]
|
||
*) mod_ssl: tighten the handling of ALPN for outgoing (proxy)
|
||
connections. If ALPN protocols are provided and sent to the
|
||
remote server, the received protocol selected is inspected
|
||
and checked for a match. Without match, the peer handshake
|
||
fails.
|
||
An exception is the proposal of "http/1.1" where it is
|
||
accepted if the remote server did not answer ALPN with
|
||
a selected protocol. This accomodates for hosts that do
|
||
not observe/support ALPN and speak http/1.x be default.
|
||
*) mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match worker instances
|
||
with others when their URLs contain a '$' substitution. PR 65419 + 65429.
|
||
[Yann Ylavic]
|
||
*) mod_dav: Add method_precondition hook. WebDAV extensions define
|
||
conditions that must exist before a WebDAV method can be executed.
|
||
This hook allows a WebDAV extension to verify these preconditions.
|
||
[Graham Leggett]
|
||
*) Add hooks deliver_report and gather_reports to mod_dav.h. Allows other
|
||
modules apart from versioning implementations to handle the REPORT method.
|
||
[Graham Leggett]
|
||
*) Add dav_get_provider(), dav_open_lockdb(), dav_close_lockdb() and
|
||
dav_get_resource() to mod_dav.h. [Graham Leggett]
|
||
*) core: fix ap_escape_quotes substitution logic. [Eric Covener]
|
||
*) Easy patches: synch 2.4.x and trunk
|
||
- mod_auth_basic: Use ap_cstr_casecmp instead of strcasecmp.
|
||
- mod_ldap: log and abort locking errors.
|
||
- mod_ldap: style fix for r1831165
|
||
- mod_ldap: build break fix for r1831165
|
||
- mod_deflate: Avoid hard-coded "%ld" format strings in mod_deflate's logging statements
|
||
- mod_deflate: Use apr_uint64_t instead of uint64_t (follow up to r1849590)
|
||
- mod_forensic: Follow up to r1856490: missing one mod_log_forensic test_char_table case.
|
||
- mod_rewrite: Save a few cycles.
|
||
- mod_request: Fix a comment (missing '_' in 'keep_body') and some style issues
|
||
- core: remove extra whitespace in HTTP_NOT_IMPLEMENTED
|
||
[Christophe Jaillet]
|
||
*) core/mpm: add hook 'child_stopping` that gets called when the MPM is
|
||
stopping a child process. The additional `graceful` parameter allows
|
||
registered hooks to free resources early during a graceful shutdown.
|
||
[Yann Ylavic, Stefan Eissing]
|
||
*) mod_proxy: Fix icomplete initialization of BalancerMember(s) from the
|
||
balancer-manager, which can lead to a crash. [Yann Ylavic]
|
||
*) mpm_event: Fix graceful stop/restart of children processes if connections
|
||
are in lingering close for too long. [Yann Ylavic]
|
||
*) mod_md: fixed a potential null pointer dereference if ACME/OCSP
|
||
server returned 2xx responses without content type. Reported by chuangwen.
|
||
[chuangwen, Stefan Eissing]
|
||
*) mod_md:
|
||
- Domain names in `<MDomain ...>` can now appear in quoted form.
|
||
- Fixed a failure in ACME challenge selection that aborted further searches
|
||
when the tls-alpn-01 method did not seem to be suitable.
|
||
- Changed the tls-alpn-01 setup to only become unsuitable when none of the
|
||
dns names showed support for a configured 'Protocols ... acme-tls/1'. This
|
||
allows use of tls-alpn-01 for dns names that are not mapped to a VirtualHost.
|
||
*) Add CPING to health check logic. [Jean-Frederic Clere]
|
||
*) core: Split ap_create_request() from ap_read_request(). [Graham Leggett]
|
||
*) core, h2: common ap_parse_request_line() and ap_check_request_header()
|
||
code. [Yann Ylavic]
|
||
*) core: Add StrictHostCheck to allow unconfigured hostnames to be
|
||
rejected. [Eric Covener]
|
||
*) htcacheclean: Improve help messages. [Christophe Jaillet]
|
||
- modified patches
|
||
% apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)
|
||
- modified sources
|
||
% apache2.keyring
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Aug 2 17:32:18 UTC 2021 - pgajdos@suse.com
|
||
|
||
- introduce APACHE_TACEENABLE sysconfig variable, which translates
|
||
to /etc/apache2/sysconfig.d/global.conf:TraceEnable on/off
|
||
- modified sources
|
||
% apache2-global.conf
|
||
% apache2-start_apache2
|
||
% sysconfig.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 2 07:31:14 UTC 2021 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.48
|
||
|
||
Changes with Apache 2.4.48
|
||
|
||
*) mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp to opt-out the
|
||
fallback to mod_proxy_http for WebSocket upgrade and tunneling.
|
||
[Yann Ylavic]
|
||
|
||
*) mod_proxy: Fix flushing of THRESHOLD_MIN_WRITE data while tunneling.
|
||
BZ 65294. [Yann Ylavic]
|
||
|
||
*) core: Fix a regression that stripped the ETag header from 304 responses.
|
||
PR 61820 [Ruediger Pluem, Roy T. Fielding]
|
||
|
||
*) core: Adding SSL related inquiry functions to the server API.
|
||
These function are always available, even when no module providing
|
||
SSL is loaded. They provide their own "shadowing" implementation for
|
||
the optional functions of similar name that mod_ssl and impersonators
|
||
of mod_ssl provide.
|
||
This enables loading of several SSL providing modules when all but
|
||
one of them registers itself into the new hooks. Two old-style SSL
|
||
modules will not work, as they replace the others optional functions
|
||
with their own.
|
||
Modules using the old-style optional functions will continue to work
|
||
as core supplies its own versions of those.
|
||
The following has been added so far:
|
||
- ap_ssl_conn_is_ssl() to query if a connection is using SSL.
|
||
- ap_ssl_var_lookup() to query SSL related variables for a
|
||
server/connection/request.
|
||
- Hooks for 'ssl_conn_is_ssl' and 'ssl_var_lookup' where modules
|
||
providing SSL can install their own value supplying functions.
|
||
- ap_ssl_add_cert_files() to enable other modules like mod_md to provide
|
||
certificate and keys for an SSL module like mod_ssl.
|
||
- ap_ssl_add_fallback_cert_files() to enable other modules like mod_md to
|
||
provide a fallback certificate in case no 'proper' certificate is
|
||
available for an SSL module like mod_ssl.
|
||
- ap_ssl_answer_challenge() to enable other modules like mod_md to
|
||
provide a certificate as used in the RFC 8555 'tls-alpn-01' challenge
|
||
for the ACME protocol for an SSL module like mod_ssl. The function
|
||
and its hook provide PEM encoded data instead of file names.
|
||
- Hooks for 'ssl_add_cert_files', 'ssl_add_fallback_cert_files' and
|
||
'ssl_answer_challenge' where modules like mod_md can provide providers
|
||
to the above mentioned functions.
|
||
- These functions reside in the new 'http_ssl.h' header file.
|
||
[Stefan Eissing]
|
||
*) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This
|
||
allows modules to access and provide OCSP response data without being tied
|
||
of each other. The data is exchanged in standard, portable formats (PEM encoded
|
||
certificates and DER encoded responses), so that the actual SSL/crypto
|
||
implementations used by the modules are independant of each other.
|
||
Registration and retrieval happen in the context of a server (server_rec)
|
||
which modules may use to decide if they are configured for this or not.
|
||
The area of changes:
|
||
1. core: defines 2 functions in include/http_ssl.h, so that modules may
|
||
register a certificate, together with its issuer certificate for OCSP
|
||
response provisioning and ask for current response data (DER bytes) later.
|
||
Also, 2 hooks are defined that allow modules to implement this OCSP
|
||
provisioning.
|
||
2. mod_ssl uses the new functions, in addition to what it did already, to
|
||
register its certificates this way. If no one is interested in providing
|
||
OCSP, it falls back to its own (if configured) stapling implementation.
|
||
3. mod_md registers itself at the core hooks for OCSP provisioning. Depending
|
||
on configuration, it will accept registrations of its own certificates only,
|
||
all certificates or none.
|
||
[Stefan Eissing]
|
||
*) mod_md: v2.4.0 with improvements and bugfixes
|
||
- MDPrivateKeys allows the specification of several types. Beside "RSA" plus
|
||
optional key lengths elliptic curves can be configured. This means you can
|
||
have multiple certificates for a Managed Domain with different key types.
|
||
With ```MDPrivateKeys secp384r1 rsa2048``` you get one ECDSA and one RSA
|
||
certificate and all modern client will use the shorter ECDSA, while older
|
||
client will get the RSA certificate.
|
||
Many thanks to @tlhackque who pushed and helped on this.
|
||
- Support added for MDomains consisting of a wildcard. Configuring
|
||
```MDomain *.host.net``` will match all virtual hosts matching that pattern
|
||
and obtain one certificate for it (assuming you have 'dns-01' challenge
|
||
support configured). Addresses #239.
|
||
- Removed support for ACMEv1 servers. The only known installation used to
|
||
be Let's Encrypt which has disabled that version more than a year ago for
|
||
new accounts.
|
||
- Andreas Ulm (<https://github.com/root360-AndreasUlm>) implemented the
|
||
```renewing``` call to ```MDMessageCmd``` that can deny a certificate
|
||
renewal attempt. This is useful in clustered installations, as
|
||
discussed in #233).
|
||
- New event ```challenge-setup:<type>:<domain>```, triggered when the
|
||
challenge data for a domain has been created. This is invoked before the
|
||
ACME server is told to check for it. The type is one of the ACME challenge
|
||
types. This is invoked for every DNS name in a MDomain.
|
||
- The max delay for retries has been raised to daily (this is like all
|
||
retries jittered somewhat to avoid repeats at fixed time of day).
|
||
- Certain error codes reported by the ACME server that indicate a problem
|
||
with the configured data now immediately switch to daily retries. For
|
||
example: if the ACME server rejects a contact email or a domain name,
|
||
frequent retries will most likely not solve the problem. But daily retries
|
||
still make sense as there might be an error at the server and un-supervised
|
||
certificate renewal is the goal. Refs #222.
|
||
- Test case and work around for domain names > 64 octets. Fixes #227.
|
||
When the first DNS name of an MD is longer than 63 octets, the certificate
|
||
request will not contain a CN field, but leave it up to the CA to choose one.
|
||
Currently, Lets Encrypt looks for a shorter name in the SAN list given and
|
||
fails the request if none is found. But it is really up to the CA (and what
|
||
browsers/libs accept here) and may change over the years. That is why
|
||
the decision is best made at the CA.
|
||
- Retry delays now have a random +/-[0-50]% modification applied to let
|
||
retries from several servers spread out more, should they have been
|
||
restarted at the same time of day.
|
||
- Fixed several places where the 'badNonce' return code from an ACME server
|
||
was not handled correctly. The test server 'pebble' simulates this behaviour
|
||
by default and helps nicely in verifying this behaviour. Thanks, pebble!
|
||
- Set the default `MDActivationDelay` to 0. This was confusing to users that
|
||
new certificates were deemed not usably before a day of delay. When clocks are
|
||
correct, using a new certificate right away should not pose a problem.
|
||
- When handling ACME authorization resources, the module no longer requires
|
||
the server to return a "Location" header, as was necessary in ACMEv1.
|
||
Fixes #216.
|
||
- Fixed a theoretical uninitialized read when testing for JSON error responses
|
||
from the ACME CA. Reported at <https://bz.apache.org/bugzilla/show_bug.cgi?id=64297>.
|
||
- ACME problem reports from CAs that include parameters in the Content-Type
|
||
header are handled correctly. (Previously, the problem text would not be
|
||
reported and retries could exceed CA limits.)
|
||
- Account Update transactions to V2 CAs now use the correct POST-AS-GET method.
|
||
Previously, an empty JSON object was sent - which apparently LE accepted,
|
||
but others reject.
|
||
[Stefan Eissing, @tlhackque, Andreas Ulm]
|
||
|
||
Changes with Apache 2.4.47
|
||
|
||
*) mod_dav_fs: Improve logging output when failing to open files for
|
||
writing. PR 64413. [Bingyu Shen <ahshenbingyu gmail.com>]
|
||
|
||
*) mod_http2: Fixed a race condition that could lead to streams being
|
||
aborted (RST to the client), although a response had been produced.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_lua: Add support to Lua 5.4 [Joe Orton, Giovanni Bechis, Ruediger Pluem]
|
||
|
||
*) MPM event/worker: Fix possible crash in child process on early signal
|
||
delivery. PR 64533. [Ruediger Pluem]
|
||
|
||
*) mod_http2: sync with github standalone version 1.15.17
|
||
- Log requests and sent the configured error response in case of early detected
|
||
errors like too many or too long headers. [Ruediger Pluem]
|
||
- new option 'H2OutputBuffering on/off' which controls the buffering of stream output.
|
||
The default is on, which is the behaviour of older mod-h2 versions. When off, all
|
||
bytes are made available immediately to the main connection for sending them
|
||
out to the client. This fixes interop issues with certain flavours of gRPC, see
|
||
also <https://github.com/icing/mod_h2/issues/207>.
|
||
[Stefan Eissing]
|
||
|
||
*) mod_unique_id: Fix potential duplicated ID generation under heavy load.
|
||
PR 65159
|
||
[Jonas Müntener <jonas.muentener ergon.ch>, Christophe Jaillet]
|
||
|
||
*) "[mod_dav_fs etag handling] should really honor the FileETag setting".
|
||
- It now does.
|
||
- Add "Digest" to FileETag directive, allowing a strong ETag to be
|
||
generated using a file digest.
|
||
- Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over
|
||
ETag generation.
|
||
- Add concept of "binary notes" to request_rec, allowing packed bit flags
|
||
to be added to a request.
|
||
- First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force
|
||
the ETag to a strong ETag to comply with RFC requirements, such as those
|
||
mandated by various WebDAV extensions.
|
||
[Graham Leggett]
|
||
|
||
*) mod_proxy_http: Fix a possibly crash when the origin connection gets
|
||
interrupted before completion. PR 64234.
|
||
[Barnim Dzwillo <dzwillo strato.de>, Ruediger Pluem]
|
||
|
||
*) mod_ssl: Do not keep connections to OCSP responders alive when doing
|
||
OCSP requests. PR 64135. [Ruediger Pluem]
|
||
|
||
*) mod_ssl: Improve the coalescing filter to buffer into larger TLS
|
||
records, and avoid revealing the HTTP header size via TLS record
|
||
boundaries (for common response generators).
|
||
[Joe Orton, Ruediger Pluem]
|
||
|
||
*) mod_proxy_hcheck: Don't pile up health checks if the previous one did
|
||
not finish before hcinterval. PR 63010. [Yann Ylavic]
|
||
|
||
*) mod_session: Improve session parsing. [Yann Yalvic]
|
||
|
||
*) mod_authnz_ldap: Prevent authentications with empty passwords for the
|
||
initial bind to fail with status 500. [Ruediger Pluem]
|
||
|
||
*) mod_auth_digest: Fast validation of the nonce's base64 to fail early if
|
||
the format can't match anyway. [Yann Ylavic]
|
||
|
||
*) mod_proxy_fcgi: Honor "SetEnv proxy-sendcl" to forward a chunked
|
||
Transfer-Encoding from the client, spooling the request body when needed
|
||
to provide a Content-Length to the backend. PR 57087. [Yann Ylavic]
|
||
|
||
*) mod_proxy: Put mod_proxy_{connect,wstunnel} tunneling code in common in
|
||
proxy_util. [Yann Ylavic]
|
||
|
||
*) mod_proxy: Improve tunneling loop to support half closed connections and
|
||
pending data draining (for protocols like rsync). PR 61616. [Yann Ylavic]
|
||
|
||
*) mod_proxy_http: handle Upgrade request, 101 (Switching Protocol) response
|
||
and switched protocol forwarding. [Yann Ylavic]
|
||
|
||
*) mod_proxy_wstunnel: Leave Upgrade requests handling to mod_proxy_http,
|
||
allowing for (non-)Upgrade negotiation with the origin server.
|
||
[Yann Ylavic]
|
||
|
||
*) mod_proxy: Allow ProxyErrorOverride to be restricted to specific status
|
||
codes. PR63628. [Martin Drößler <mail martindroessler.de>]
|
||
|
||
*) core: Add ReadBufferSize, FlushMaxThreshold and FlushMaxPipelined
|
||
directives. [Yann Ylavic]
|
||
|
||
*) core: Ensure that aborted connections are logged as such. PR 62823
|
||
[Arnaud Grandville <contact@grandville.net>]
|
||
|
||
*) http: Allow unknown response status' lines returned in the form of
|
||
"HTTP/x.x xxx Status xxx". [Yann Ylavic]
|
||
|
||
*) mod_proxy_http: Fix 100-continue deadlock for spooled request bodies,
|
||
leading to Request Timeout (408). PR 63855. [Yann Ylavic]
|
||
*) core: Remove headers on 304 Not Modified as specified by RFC7234, as
|
||
opposed to passing an explicit subset of headers. PR 61820.
|
||
[Giovanni Bechis]
|
||
|
||
*) mpm_event: Don't reset connections after lingering close, restoring prior
|
||
to 2.4.28 behaviour. [Yann Ylavic]
|
||
|
||
*) mpm_event: Kill connections in keepalive state only when there is no more
|
||
workers available, not when the maximum number of connections is reached,
|
||
restoring prior to 2.4.30 behaviour. [Yann Ylavic]
|
||
|
||
*) mod_unique_id: Use base64url encoding for UNIQUE_ID variable,
|
||
avoiding the use of '@'. PR 57044.
|
||
[Michael Kaufmann <apache-bugzilla michael-kaufmann.ch>]
|
||
|
||
*) mod_rewrite: Extend the [CO] (cookie) flag of RewriteRule to accept a
|
||
SameSite attribute. [Eric Covener]
|
||
|
||
*) mod_proxy: Add proxy check_trans hook. This allows proxy
|
||
modules to decline request handling at early stage.
|
||
|
||
*) mod_proxy_wstunnel: Decline requests without an Upgrade
|
||
header so ws/wss can be enabled overlapping with later
|
||
http/https.
|
||
|
||
*) mod_http2: Log requests and sent the configured error response in case of
|
||
early detected errors like too many or too long headers.
|
||
[Ruediger Pluem, Stefan Eissing]
|
||
|
||
*) mod_md: Lowered the required minimal libcurl version from 7.50 to 7.29
|
||
as proposed by <alexander.gerasimov codeit.pro>. [Stefan Eissing]
|
||
|
||
*) mod_ssl: Fix request body buffering with PHA in TLSv1.3. [Joe Orton]
|
||
|
||
*) mod_proxy_uwsgi: Fix a crash when sending environment variables with no
|
||
value. PR 64598 [Ruediger Pluem]
|
||
|
||
*) mod_proxy: Recognize parameters from ProxyPassMatch workers with dollar
|
||
substitution, such that they apply to the backend connection. Note that
|
||
connection reuse is disabled by default to avoid compatibility issues.
|
||
[Takashi Sato, Jan Kaluza, Eric Covener, Yann Ylavic, Jean-Frederic Clere]
|
||
- modified sources
|
||
% apache2.keyring
|
||
- deleted patches
|
||
- apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)
|
||
- lua54.patch (upstreamed)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 27 17:42:09 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
||
|
||
- Add lua54.patch to fix building with lua54
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 22 12:25:23 UTC 2021 - Michael Ströder <michael@stroeder.com>
|
||
|
||
- added Provides: http_daemon to fix bsc#1180132
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 22 07:44:28 UTC 2021 - pgajdos@suse.com
|
||
|
||
- remove suexec2 from premissions as well
|
||
- modified sources
|
||
% permissions.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 13 20:16:34 UTC 2021 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- suexec2 was renamed to suexec in 2015 and the symlink to suexec
|
||
no longer exists
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 12 22:29:52 UTC 2021 - Christian Boltz <suse-beta@cboltz.de>
|
||
|
||
- re-add rcapache2 symlink (was lost about 6 weeks ago)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 12 11:24:20 UTC 2021 - pgajdos@suse.com
|
||
|
||
- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
|
||
- modified sources
|
||
% apache2-gensslcert
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 8 14:59:12 UTC 2021 - pgajdos@suse.com
|
||
|
||
- mod_php8 provides php_module
|
||
- modified sources
|
||
% apache2-script-helpers
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 17 17:22:23 UTC 2020 - pgajdos@suse.com
|
||
|
||
- obsolete apache2-example-page and obsolete/provide apache2-doc
|
||
[bsc#180075]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 14 11:19:46 UTC 2020 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- only include BuildRequires: apache2-{prefork,worker,event} used in
|
||
test target
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 11 20:01:03 UTC 2020 - pgajdos@suse.com
|
||
|
||
- added https://httpd.apache.org/server-status like server status
|
||
(configured by APACHE_EXTENDED_STATUS="lua")
|
||
- modified sources
|
||
% apache2-mod_status.conf
|
||
% apache2-start_apache2
|
||
% sysconfig.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 10 16:45:36 UTC 2020 - pgajdos@suse.com
|
||
|
||
- actually install suse provided READMEs
|
||
- install upstream configuration example
|
||
- added sources
|
||
+ apache2-README-configuration.txt
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 9 19:36:02 UTC 2020 - pgajdos@suse.com
|
||
|
||
- apxs -q PREFIX now returns /srv/www again
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 9 08:00:12 UTC 2020 - Dominique Leuenberger <dleuenberger@suse.com>
|
||
|
||
- Require /usr/bin/which instead of which: allow usage of busybox
|
||
variant for containers.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 7 14:08:42 UTC 2020 - pgajdos@suse.com
|
||
|
||
- apache2 main package recommends apache2-utils
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 3 11:23:48 UTC 2020 - pgajdos@suse.com
|
||
|
||
- break some long lines in the spec as requested by review team
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Dec 1 13:14:29 UTC 2020 - pgajdos@suse.com
|
||
|
||
- maybe make spec acceptable for factory bot
|
||
- modified sources
|
||
% _multibuild
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Dec 1 09:44:08 UTC 2020 - pgajdos@suse.com
|
||
|
||
- buildrequire netcfg for tests
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Nov 29 13:45:39 UTC 2020 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- remove Requires(post): firewalld hard dependency (this is already
|
||
handled by the %firewalld_reload macro)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 26 12:10:52 UTC 2020 - pgajdos@suse.com
|
||
|
||
- package reworked trough [bsc#1178478]
|
||
- modified patches
|
||
% apache2-mod_proxy_uwsgi-fix-crash.patch (refreshed)
|
||
- modified sources
|
||
% apache2-loadmodule.conf
|
||
% apache2-manual.conf
|
||
% apache2-script-helpers
|
||
% apache2@.service
|
||
% sysconfig.apache2
|
||
- deleted patches
|
||
- deprecated-scripts-arch.patch (not needed)
|
||
- httpd-2.0.54-envvars.dif (not needed)
|
||
- httpd-2.1.3alpha-layout.dif
|
||
(renamed to apache2-system-dirs-layout.patch)
|
||
- httpd-2.2.0-apxs-a2enmod.dif (not needed)
|
||
- httpd-2.4.9-bnc690734.patch
|
||
(renamed to apache2-LimitRequestFieldSize-limits-headers.patch)
|
||
- httpd-2.4.x-fate317766-config-control-two-protocol-options.diff
|
||
(renamed to apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch)
|
||
- httpd-2.x.x-logresolve.patch
|
||
(renamed to apache2-logresolve-tmp-security.patch)
|
||
- httpd-apachectl.patch
|
||
(renamed to apache2-apachectl.patch)
|
||
- httpd-implicit-pointer-decl.patch (not needed)
|
||
- httpd-visibility.patch (not needed)
|
||
- deleted sources
|
||
- SUSE-NOTICE (outdated)
|
||
- a2enflag (renamed to apache2-a2enflag)
|
||
- a2enmod (renamed to apache2-a2enmod)
|
||
- apache-22-24-upgrade (outdated)
|
||
- apache2-README (outdated)
|
||
- apache2-README.QUICKSTART (outedated)
|
||
- apache2-find-directives (renamed to apache2-find_directives)
|
||
- apache2-init.logrotate (not needed)
|
||
- apache2.firewalld (renamed to firewalld.apache2)
|
||
- apache2.logrotate (renamed to logrotate.apache2)
|
||
- apache2.ssl.firewalld (renamed to firewalld-ssl.apache2)
|
||
- apache2.ssl.susefirewall (renamed to susefirewall.apache2)
|
||
- apache2.susefirewall (renamed to susefirewall-ssl.apache2)
|
||
- favicon.ico (not needed)
|
||
- rc.apache2 (not needed)
|
||
- robots.txt (not needed)
|
||
- sysconf_addword (not needed, in aaa_base)
|
||
- added patches
|
||
fix PATCH: https://marc.info/?l=apache-httpd-users&m=147448312531134&w=2
|
||
+ apache-test-application-xml-type.patch
|
||
fix these variables from the test
|
||
+ apache-test-turn-off-variables-in-ssl-var-lookup.patch
|
||
fix [fate317766] backport of an upstream commit
|
||
+ apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
|
||
fix [bnc#690734] TODO, to be upstreamed
|
||
+ apache2-LimitRequestFieldSize-limits-headers.patch
|
||
fix apachectl is frontend for start_apache2, suse specific
|
||
+ apache2-apachectl.patch
|
||
fix [bnc#210904] perhaps to be upstreamed
|
||
+ apache2-logresolve-tmp-security.patch
|
||
fix layout of system dirs configuration, may be upstreamed
|
||
+ apache2-system-dirs-layout.patch
|
||
- added sources
|
||
+ _multibuild
|
||
+ apache2-a2enflag
|
||
+ apache2-a2enmod
|
||
+ apache2-find_directives
|
||
+ apache2-gensslcert
|
||
+ apache2-mod_example.c
|
||
+ apache2-start_apache2
|
||
+ firewalld-ssl.apache2
|
||
+ firewalld.apache2
|
||
+ logrotate.apache2
|
||
+ susefirewall-ssl.apache2
|
||
+ susefirewall.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 14 09:43:08 UTC 2020 - Franck Bui <fbui@suse.com>
|
||
|
||
- /var/run is depracted, /run should be used instead
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 14 06:43:21 UTC 2020 - Franck Bui <fbui@suse.com>
|
||
|
||
- systemd-ask-password is located in /usr/bin
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 22 09:12:31 UTC 2020 - Jacek Tomasiak <jtomasiak@suse.com>
|
||
|
||
- gensslcert: fix SAN in final cert generation
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 11 15:24:39 UTC 2020 - Franck Bui <fbui@suse.com>
|
||
|
||
- Make use of %service_del_postun_without_restart
|
||
|
||
And stop using DISABLE_RESTART_ON_UPDATE as this interface is
|
||
obsolete.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Aug 31 11:08:16 UTC 2020 - Jacek Tomasiak <jtomasiak@suse.com>
|
||
|
||
- gensslcert: add -a argument to override default SAN value
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 31 09:07:44 UTC 2020 - Antonio Larrosa <alarrosa@suse.com>
|
||
|
||
- Provide mod_ssl to keep compatibility with other distributions.
|
||
Now obsoletes mod_ssl < %{version} instead of mod_ssl < 2.8.16.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 27 11:33:07 UTC 2020 - Dominique Leuenberger <dimstar@opensuse.org>
|
||
|
||
- Install firewalld service files to %{_prefix}/lib/firewalld, NOT
|
||
%{_libexecdir}/firewalld (boo#1174075).
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 7 12:25:58 UTC 2020 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.46
|
||
Changes with Apache 2.4.46
|
||
*) mod_proxy_fcgi: Fix build warnings for Windows platform
|
||
[Eric Covener, Christophe Jaillet]
|
||
Changes with Apache 2.4.45
|
||
*) mod_http2: remove support for abandoned http-wg draft
|
||
<https://datatracker.ietf.org/doc/draft-kazuho-h2-cache-digest/>.
|
||
[Stefan Eissing]
|
||
Changes with Apache 2.4.44
|
||
*) mod_proxy_uwsgi: Error out on HTTP header larger than 16K (hard
|
||
protocol limit). [Yann Ylavic]
|
||
*) mod_http2:
|
||
Fixes <https://github.com/icing/mod_h2/issues/200>:
|
||
"LimitRequestFields 0" now disables the limit, as documented.
|
||
Fixes <https://github.com/icing/mod_h2/issues/201>:
|
||
Do not count repeated headers with same name against the field
|
||
count limit. The are merged internally, as if sent in a single HTTP/1 line.
|
||
[Stefan Eissing]
|
||
*) mod_http2: Avoid segfaults in case of handling certain responses for
|
||
already aborted connections. [Stefan Eissing, Ruediger Pluem]
|
||
*) mod_http2: The module now handles master/secondary connections and has marked
|
||
methods according to use. [Stefan Eissing]
|
||
*) core: Drop an invalid Last-Modified header value coming
|
||
from a FCGI/CGI script instead of replacing it with Unix epoch.
|
||
[Yann Ylavic, Luca Toscano]
|
||
*) Add support for strict content-length parsing through addition of
|
||
ap_parse_strict_length() [Yann Ylavic]
|
||
*) mod_proxy_fcgi: ProxyFCGISetEnvIf unsets variables when expression
|
||
evaluates to false. PR64365. [Michael König <mail ikoenig.net>]
|
||
*) mod_proxy_http: flush spooled request body in one go to avoid
|
||
leaking (or long lived) temporary file. PR 64452. [Yann Ylavic]
|
||
*) mod_ssl: Fix a race condition and possible crash when using a proxy client
|
||
certificate (SSLProxyMachineCertificateFile).
|
||
[Armin Abfalterer <a.abfalterer gmail.com>]
|
||
*) mod_ssl: Fix memory leak in stapling code. PR63687. [Stefan Eissing]
|
||
*) mod_http2: Fixed regression that no longer set H2_STREAM_ID and H2_STREAM_TAG.
|
||
PR64330 [Stefan Eissing]
|
||
*) mod_http2: Fixed regression that caused connections to close when mod_reqtimeout
|
||
was configured with a handshake timeout. Fixes gitub issue #196.
|
||
[Stefan Eissing]
|
||
*) mod_proxy_http2: the "ping" proxy parameter
|
||
(see <https://httpd.apache.org/docs/2.4/mod/mod_proxy.html>) is now used
|
||
when checking the liveliness of a new or reused h2 connection to the backend.
|
||
With short durations, this makes load-balancing more responsive. The module
|
||
will hold back requests until ping conditions are met, using features of the
|
||
HTTP/2 protocol alone. [Ruediger Pluem, Stefan Eissing]
|
||
*) core: httpd is no longer linked against -lsystemd if mod_systemd
|
||
is enabled (and built as a DSO). [Rainer Jung]
|
||
*) mod_proxy_http2: respect ProxyTimeout settings on backend connections
|
||
while waiting on incoming data. [Ruediger Pluem, Stefan Eissing]
|
||
- modified patches
|
||
% apache2-mod_proxy_uwsgi-fix-crash.patch (refreshed)
|
||
- modified sources
|
||
% apache2.keyring
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 15 09:16:02 UTC 2020 - pgajdos@suse.com
|
||
|
||
- fix crash in mod_proxy_uwsgi for empty values of environment
|
||
variables [bsc#1174052]
|
||
- added patches
|
||
fix https://svn.apache.org/viewvc?view=revision
|
||
+ apache2-mod_proxy_uwsgi-fix-crash.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 3 12:09:55 UTC 2020 - pgajdos@suse.com
|
||
|
||
- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
|
||
(thanks to mliska@suse.com)
|
||
- modified patches
|
||
% httpd-visibility.patch (refreshed)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Apr 2 08:56:48 UTC 2020 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.43
|
||
*) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
|
||
*) mod_proxy_http: Fix the forwarding of requests with content body when a
|
||
balancer member is unavailable; the retry on the next member was issued
|
||
with an empty body (regression introduced in 2.4.41). PR63891.
|
||
[Yann Ylavic]
|
||
*) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
|
||
identifier under load, see <https://github.com/icing/mod_h2/issues/195>.
|
||
[Michael Kaufmann, Stefan Eissing]
|
||
*) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
|
||
PR64140. [Renier Velazco <renier.velazco upr.edu>]
|
||
*) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
|
||
PR64172.
|
||
*) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
|
||
to allow customization of the usertrack cookie. PR64077.
|
||
[Prashant Keshvani <prashant2400 gmail.com>, Eric Covener]
|
||
*) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
|
||
AJP13 authentication. PR 53098. [Dmitry A. Bakshaev <dab1818 gmail com>]
|
||
*) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
|
||
[Eric Covener, Yann Ylavic]
|
||
*) Add a config layout for OpenWRT. [Graham Leggett]
|
||
*) Add support for cross compiling to apxs. If apxs is being executed from
|
||
somewhere other than its target location, add that prefix to includes and
|
||
library directories. Without this, apxs would fail to find config_vars.mk
|
||
and exit. [Graham Leggett]
|
||
*) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
|
||
issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
|
||
[Michael Kaufmann <mail michael-kaufmann.ch>, Stefan Eissing]
|
||
*) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
|
||
[Graham Leggett]
|
||
*) mod_ssl: Support use of private keys and certificates from an
|
||
OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
|
||
[Anderson Sasaki <ansasaki redhat.com>, Joe Orton]
|
||
*) mod_md:
|
||
- Prefer MDContactEmail directive to ServerAdmin for registration. New directive
|
||
thanks to Timothe Litt (@tlhackque).
|
||
- protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
|
||
check all matching virtual hosts for protocol support. Thanks to @mkauf.
|
||
- Corrected a check when OCSP stapling was configured for hosts
|
||
where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
|
||
- Softening the restrictions where mod_md configuration directives may appear. This should
|
||
allow for use in <If> and <Macro> sections. If all possible variations lead to the configuration
|
||
you wanted in the first place, is another matter.
|
||
[Michael Kaufmann <mail michael-kaufmann.ch>, Timothe Litt (@tlhackque),
|
||
Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
|
||
*) test: Added continuous testing with Travis CI.
|
||
This tests various scenarios on Ubuntu with the full test suite.
|
||
Architectures tested: amd64, s390x, ppc64le, arm64
|
||
The tests pass successfully.
|
||
[Luca Toscano, Joe Orton, Mike Rumph, and others]
|
||
*) core: Be stricter in parsing of Transfer-Encoding headers.
|
||
[ZeddYu <zeddyu.lu gmail.com>, Eric Covener]
|
||
*) mod_ssl: negotiate the TLS protocol version per name based vhost
|
||
configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
|
||
SSLProtocol (from the first vhost declared on the IP:port) is now only
|
||
relevant if no SSLProtocol is declared for the vhost or globally,
|
||
otherwise the vhost or global value apply. [Yann Ylavic]
|
||
*) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
|
||
output. PR 64096. [Joe Orton]
|
||
*) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
|
||
[Giovanni Bechis <giovanni paclan.it>, Jim Jagielski]
|
||
*) mod_systemd: New module providing integration with systemd. [Jan Kaluza]
|
||
*) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
|
||
r:notes_table, r:subprocess_env_table as read-only native table alternatives
|
||
that can be iterated over. [Eric Covener]
|
||
*) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
|
||
[Yann Ylavic, Stefan Eissing]
|
||
*) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
|
||
r.headers_out, etc) to remove the key from the table. PR63971.
|
||
[Eric Covener]
|
||
*) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
|
||
ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
|
||
always `on`, regardless of configuration. Found and reported by
|
||
<Armin.Abfalterer@united-security-providers.ch> and
|
||
<Marcial.Rion@united-security-providers.ch>. [Stefan Eissing]
|
||
*) mod_http2: Multiple field length violations in the same request no longer cause
|
||
several log entries to be written. [@mkauf]
|
||
*) mod_ssl: OCSP does not apply to proxy mode. PR 63679.
|
||
[Lubos Uhliarik <luhliari redhat.com>, Yann Ylavic]
|
||
*) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
|
||
[Jim Jagielski]
|
||
*) mod_authn_socache: Increase the maximum length of strings that can be cached by
|
||
the module from 100 to 256. PR 62149 [<thorsten.meinl knime.com>]
|
||
*) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
|
||
[Ruediger Pluem, Eric Covener]
|
||
*) core: On Windows, fix a start-up crash if <IfFile ...> is used with a path that is not
|
||
valid (For example, testing for a file on a flash drive that is not mounted)
|
||
[Christophe Jaillet]
|
||
*) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
|
||
means 'foo' is "not acceptable". PR 58158 [Chistophe Jaillet]
|
||
*) mod_md v2.2.3:
|
||
- Configuring MDCAChallenges replaces any previous existing challenge configuration. It
|
||
had been additive before which was not the intended behaviour. [@mkauf]
|
||
- Fixing order of ACME challenges used when nothing else configured. Code now behaves as
|
||
documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
|
||
- Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
|
||
- Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
|
||
"transfer-encoding" to POST requests. This failed in directy communication with
|
||
Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
|
||
*) mod_md: Adding the several new features.
|
||
The module offers an implementation of OCSP Stapling that can replace fully or
|
||
for a limited set of domains the existing one from mod_ssl. OCSP handling
|
||
is part of mod_md's monitoring and message notifications. If can be used
|
||
for sites that do not have ACME certificates.
|
||
The url for a CTLog Monitor can be configured. It is used in the server-status
|
||
to link to the external status page of a certicate.
|
||
The MDMessageCmd is called with argument "installed" when a new certificate
|
||
has been activated on server restart/reload. This allows for processing of
|
||
the new certificate, for example to applications that require it in different
|
||
locations or formats.
|
||
[Stefan Eissing]
|
||
*) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
|
||
protection. PR 63688. [Armin Abfalterer <a.abfalterer gmail.com>]
|
||
- deleted patches
|
||
- apache2-load-private-keys-from-pkcs11.patch (upstreamed)
|
||
- httpd-2.4.3-mod_systemd.patch (upstreamed)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 26 10:33:47 UTC 2020 - pgajdos@suse.com
|
||
|
||
- use r1874196 [SLE-7653]
|
||
- modified patches
|
||
% apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
|
||
- deleted patches
|
||
- apache2-load-certificates-from-pkcs11.patch (merged to above)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 18 12:49:55 UTC 2020 - pgajdos@suse.com
|
||
|
||
- require just libbrotli-devel
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 13 18:38:57 UTC 2020 - pgajdos@suse.com
|
||
|
||
- build mod_proxy_http2 extension
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 12 13:13:05 UTC 2020 - pgajdos@suse.com
|
||
|
||
- fix build for older distributions
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 31 18:22:09 UTC 2020 - Cristian Rodríguez <crrodriguez@opensuse.org>
|
||
|
||
- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
|
||
to honour net.core.somaxconn sysctl as the mandatory limit.
|
||
the old value of 511 was never used as until v5.4-rc6 it was
|
||
clamped to 128, in current kernels the default limit is 4096.
|
||
Cannot use the apr_socket_listen(.., -1) idiom because the function
|
||
expects a positive integer argument.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 20 13:04:23 UTC 2020 - pgajdos@suse.com
|
||
|
||
- apache2-devel now provides httpd-devel [bsc#1160100]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 18 16:36:08 UTC 2019 - pgajdos@suse.com
|
||
|
||
- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
|
||
- modified sources
|
||
% apache2-ssl-global.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 8 08:58:25 UTC 2019 - pgajdos@suse.com
|
||
|
||
- use %license [bsc#1156171]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 22 07:01:23 UTC 2019 - pgajdos@suse.com
|
||
|
||
- load private keys and certificates from pkcs11 token [SLE-7653]
|
||
- added patches
|
||
load certificates from openssl engine
|
||
+ apache2-load-certificates-from-pkcs11.patch
|
||
load private keys from openssl engine
|
||
+ apache2-load-private-keys-from-pkcs11.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Oct 5 14:03:54 UTC 2019 - Yunhe Guo <i@guoyunhe.me>
|
||
|
||
- Add custom log files to logrotate according to apache2-vhost.template
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 23 18:06:12 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
|
||
|
||
- Remove redundant metadata from summary.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 15 09:05:22 UTC 2019 - Michael Ströder <michael@stroeder.com>
|
||
|
||
- version update to 2.4.41 with security fixes:
|
||
* low: Limited cross-site scripting in mod_proxy
|
||
error page (CVE-2019-10092)
|
||
* low: mod_rewrite potential open redirect (CVE-2019-10098)
|
||
* moderate: mod_http2, read-after-free in h2
|
||
connection shutdown (CVE-2019-10082)
|
||
* moderate: mod_http2, memory corruption on
|
||
early pushes (CVE-2019-10081)
|
||
* moderate: mod_http2, DoS attack by exhausting
|
||
h2 workers. (CVE-2019-9517)
|
||
* moderate: mod_remoteip: Stack buffer overflow and
|
||
NULL pointer dereference (CVE-2019-10097)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 26 07:34:16 UTC 2019 - pgajdos@suse.com
|
||
|
||
- fix typo
|
||
- modified sources
|
||
% apache2-README-instances.txt
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 13 14:31:22 UTC 2019 - pgajdos@suse.com
|
||
|
||
- revive apache-22-24-upgrade [bsc#1134294] (internal)
|
||
- added sources
|
||
+ apache-22-24-upgrade
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Apr 2 10:26:21 UTC 2019 - pgajdos@suse.com
|
||
|
||
- version update to 2.4.39
|
||
* mod_proxy/ssl: Cleanup per-request SSL configuration anytime a
|
||
backend connection is recycled/reused to avoid a possible crash
|
||
with some SSLProxy configurations in <Location> or <Proxy>
|
||
context. PR 63256. [Yann Ylavic]
|
||
* mod_ssl: Correctly restore SSL verify state after TLSv1.3 PHA
|
||
failure. [Michael Kaufmann <mail michael-kaufmann.ch>]
|
||
* mod_log_config: Support %{c}h for conn-hostname, %h for
|
||
useragent_host PR 55348
|
||
* mod_socache_redis: Support for Redis as socache storage
|
||
provider.
|
||
* core: new configuration option 'MergeSlashes on|off' that
|
||
controls handling of multiple, consecutive slash ('/')
|
||
characters in the path component of the request URL. [Eric
|
||
Covener]
|
||
* mod_http2: when SSL renegotiation is inhibited and a 403
|
||
ErrorDocument is in play, the proper HTTP/2 stream reset did
|
||
not trigger with H2_ERR_HTTP_1_1_REQUIRED. Fixed. [Michael
|
||
Kaufmann]
|
||
* mod_http2: new configuration directive: `H2Padding numbits` to
|
||
control padding of HTTP/2 payload frames. 'numbits' is a number
|
||
from 0-8, controlling the range of padding bytes added to a
|
||
frame. The actual number added is chosen randomly per frame.
|
||
This applies to HEADERS, DATA and PUSH_PROMISE frames equally.
|
||
The default continues to be 0, e.g. no padding. [Stefan
|
||
Eissing]
|
||
* mod_http2: ripping out all the h2_req_engine internal features
|
||
now that mod_proxy_http2 has no more need for it. Optional
|
||
functions are still declared but no longer implemented. While
|
||
previous mod_proxy_http2 will work with this, it is
|
||
recommeneded to run the matching versions of both modules.
|
||
[Stefan Eissing]
|
||
* mod_proxy_http2: changed mod_proxy_http2 implementation and
|
||
fixed several bugs which resolve PR63170. The proxy module does
|
||
now a single h2 request on the (reused) connection and returns.
|
||
[Stefan Eissing]
|
||
* mod_http2/mod_proxy_http2: proxy_http2 checks correct master
|
||
connection aborted status to trigger immediate shutdown of
|
||
backend connections. This is now always signalled by mod_http2
|
||
when the the session is being released. proxy_http2 now only
|
||
sends a PING frame to the backend when there is not already one
|
||
in flight. [Stefan Eissing]
|
||
* mod_proxy_http2: fixed an issue where a proxy_http2 handler
|
||
entered an infinite loop when encountering certain errors on
|
||
the backend connection. See
|
||
<https://bz.apache.org/bugzilla/show_bug.cgi?id=63170>. [Stefan
|
||
Eissing]
|
||
* mod_http2: Configuration directives H2Push and H2Upgrade can
|
||
now be specified per Location/Directory, e.g. disabling PUSH
|
||
for a specific set of resources. [Stefan Eissing]
|
||
* mod_http2: HEAD requests to some module such as mod_cgid caused
|
||
the stream to terminate improperly and cause a HTTP/2
|
||
PROTOCOL_ERROR. Fixes
|
||
<https://github.com/icing/mod_h2/issues/167>. [Michael
|
||
Kaufmann]
|
||
* http: Fix possible empty response with mod_ratelimit for HEAD
|
||
requests. PR 63192. [Yann Ylavic]
|
||
* mod_cache_socache: Avoid reallocations and be safe with
|
||
outgoing data lifetime. [Yann Ylavic]
|
||
* MPMs unix: bind the bucket number of each child to its slot
|
||
number, for a more efficient per bucket maintenance. [Yann
|
||
Ylavic]
|
||
* mod_auth_digest: Fix a race condition. Authentication with
|
||
valid credentials could be refused in case of concurrent
|
||
accesses from different users. PR 63124. [Simon Kappel
|
||
<simon.kappel axis.com>]
|
||
* mod_http2: enable re-use of slave connections again. Fixed
|
||
slave connection keepalives counter. [Stefan Eissing]
|
||
* mod_reqtimeout: Allow to configure (TLS-)handshake timeouts. PR
|
||
61310. [Yann Ylavic]
|
||
* mod_proxy_wstunnel: Fix websocket proxy over UDS. PR 62932
|
||
<pavel dcmsys.com>
|
||
* mod_ssl: Don't unset FIPS mode on restart unless it's forced by
|
||
configuration (SSLFIPS on) and not active by default in
|
||
OpenSSL. PR 63136. [Yann Ylavic]
|
||
- deleted patches
|
||
- apache2-mod_http2-issue-167.patch (upstreamed)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 18 21:44:17 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
|
||
|
||
- Reduce scriptlets' hard dependency on systemd.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 27 14:15:52 UTC 2019 - pgajdos@suse.com
|
||
|
||
- added patches
|
||
fix https://github.com/icing/mod_h2/issues/167 [bsc#1125965]
|
||
+ apache2-mod_http2-issue-167.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 8 01:58:37 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
|
||
|
||
- Replace old $RPM_* shell vars. Avoid old tar syntax.
|
||
- Tag scriptlets as explicitly requiring bash.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 18 15:12:08 UTC 2019 - Manu Maier <mmanu84@outlook.de>
|
||
|
||
- updated to 2.4.38
|
||
* mod_ssl: Clear retry flag before aborting client-initiated renegotiation.
|
||
PR 63052 [Joe Orton]
|
||
* mod_negotiation: Treat LanguagePriority as case-insensitive to match
|
||
AddLanguage behavior and HTTP specification. PR 39730 [Christophe Jaillet]
|
||
* mod_md: incorrect behaviour when synchronizing ongoing ACME challenges
|
||
have been fixed. [Michael Kaufmann, Stefan Eissing]
|
||
* mod_setenvif: We can have expressions that become true if a regex pattern
|
||
in the expression does NOT match. In this case val is NULL
|
||
and we should just set the value for the environment variable
|
||
like in the pattern case. [Ruediger Pluem]
|
||
* mod_session: Always decode session attributes early. [Hank Ibell]
|
||
* core: Incorrect values for environment variables are substituted when
|
||
multiple environment variables are specified in a directive. [Hank Ibell]
|
||
* mod_rewrite: Only create the global mutex used by "RewriteMap prg:" when
|
||
this type of map is present in the configuration. PR62311.
|
||
[Hank Ibell <hwibell gmail.com>]
|
||
* mod_dav: Fix invalid Location header when a resource is created by
|
||
passing an absolute URI on the request line [Jim Jagielski]
|
||
* mod_session_cookie: avoid duplicate Set-Cookie header in the response.
|
||
[Emmanuel Dreyfus <manu@netbsd.org>, Luca Toscano]
|
||
* mod_ssl: clear *SSL errors before loading certificates and checking
|
||
afterwards. Otherwise errors are reported when other SSL using modules
|
||
are in play. Fixes PR 62880. [Michael Kaufmann]
|
||
* mod_ssl: Fix the error code returned in an error path of
|
||
'ssl_io_filter_handshake()'. This messes-up error handling performed
|
||
in 'ssl_io_filter_error()' [Yann Ylavic]
|
||
* mod_ssl: Fix $HTTPS definition for "SSLEngine optional" case, and fix
|
||
authz provider so "Require ssl" works correctly in HTTP/2.
|
||
PR 61519, 62654. [Joe Orton, Stefan Eissing]
|
||
* mod_proxy: If ProxyPassReverse is used for reverse mapping of relative
|
||
redirects, subsequent ProxyPassReverse statements, whether they are
|
||
relative or absolute, may fail. PR 60408. [Peter Haworth <pmh1wheel gmail.com>]
|
||
* mod_lua: Now marked as a stable module [https://s.apache.org/Xnh1]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 16 08:56:20 UTC 2019 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- SSLProtocol use TLSv1.2 or higher
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 9 10:26:46 UTC 2019 - Petr Gajdos <pgajdos@suse.com>
|
||
|
||
- do not create sysconfig.d when already exists [bsc#1121086]
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jan 6 15:14:43 UTC 2019 - Dirk Mueller <dmueller@suse.com>
|
||
|
||
- use secure http sites by default in configs
|
||
- Switch to DEFAULT_SUSE Cipher suite
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 25 17:28:42 UTC 2018 - Arjen de Korte <suse+build@de-korte.org>
|
||
|
||
- the "event" MPM is fully supported since 2.4
|
||
- configure an OCSP stapling cache by default (still requires enabling
|
||
SSLUseStapling in vhost)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 18 20:41:02 UTC 2018 - Manu Maier <mmanu84@outlook.de>
|
||
|
||
- updated to 2.4.37
|
||
* mod_ssl: Fix HTTP/2 failures when using OpenSSL 1.1.1. [Rainer Jung]
|
||
* mod_ssl: Fix crash during SSL renegotiation with OptRenegotiate set,
|
||
when client certificates are available from the original handshake
|
||
but were originally not verified and should get verified now.
|
||
This is a regression in 2.4.36 (unreleased). [Ruediger Pluem]
|
||
* mod_ssl: Correctly merge configurations that have client certificates set
|
||
by SSLProxyMachineCertificate{File|Path}. [Ruediger Pluem]
|
||
- updated to 2.4.36
|
||
* mod_brotli, mod_deflate: Restore the separate handling of 304 Not Modified
|
||
responses. Regression introduced in 2.4.35.
|
||
* mod_proxy_scgi, mod_proxy_uwsgi: improve error handling when sending the
|
||
body of the response. [Jim Jagielski]
|
||
* mod_http2: adding defensive code for stream EOS handling, in case the request handler
|
||
missed to signal it the normal way (eos buckets). Addresses github issues
|
||
https://github.com/icing/mod_h2/issues/164, https://github.com/icing/mod_h2/issues/167
|
||
and https://github.com/icing/mod_h2/issues/170. [Stefan Eissing]
|
||
* ab: Add client certificate support. [Graham Leggett]
|
||
* ab: Disable printing temp key for OpenSSL before
|
||
version 1.0.2. SSL_get_server_tmp_key is not available
|
||
there. [Rainer Jung]
|
||
* mod_ssl: Fix a regression that the configuration settings for verify mode
|
||
and verify depth were taken from the frontend connection in case of
|
||
connections by the proxy to the backend. PR 62769. [Ruediger Pluem]
|
||
* MPMs: Initialize all runtime/asynchronous objects on a dedicated pool and
|
||
before signals handling to avoid lifetime issues on restart or shutdown.
|
||
PR 62658. [Yann Ylavic]
|
||
* mod_ssl: Add support for OpenSSL 1.1.1 and TLSv1.3. TLSv1.3 has
|
||
behavioural changes compared to v1.2 and earlier; client and
|
||
configuration changes should be expected. SSLCipherSuite is
|
||
enhanced for TLSv1.3 ciphers, but applies at vhost level only.
|
||
[Stefan Eissing, Yann Ylavic, Ruediger Pluem, Joe Orton]
|
||
* mod_auth_basic: Be less tolerant when parsing the credencial. Only spaces
|
||
should be accepted after the authorization scheme. \t are also tolerated.
|
||
[Christophe Jaillet]
|
||
* mod_proxy_hcheck: Fix issues with interval determination. PR 62318
|
||
[Jim Jagielski]
|
||
* mod_proxy_hcheck: Fix issues with TCP health checks. PR 61499
|
||
[Dominik Stillhard <dominik.stillhard united-security-providers.ch>]
|
||
* mod_proxy_hcheck: take balancer's SSLProxy* directives into account.
|
||
[Jim Jagielski]
|
||
* mod_status, mod_echo: Fix the display of client addresses.
|
||
They were truncated to 31 characters which is not enough for IPv6 addresses.
|
||
This is done by deprecating the use of the 'client' field and using
|
||
the new 'client64' field in worker_score.
|
||
PR 54848 [Bernhard Schmidt <berni birkenwald de>, Jim Jagielski]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 1 13:38:05 UTC 2018 - Petr Gajdos <pgajdos@suse.com>
|
||
|
||
- consider also patterns in APACHE_CONF_INCLUDE_DIRS as documentation
|
||
says (patch Juergen Gleiss)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 27 10:25:40 UTC 2018 - Petr Gajdos <pgajdos@suse.com>
|
||
|
||
- relink /usr/sbin/httpd after apache2-MPM uninstall [bsc#1107930c#1]
|
||
- simplify find_mpm function from script-helpers
|
||
- /usr/sbin/httpd is now created depending on preference hardcoded
|
||
in find_mpm (script-helpers), not depending on alphabetical
|
||
order of MPMs
|
||
- simplify spec file a bit
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 24 12:53:08 UTC 2018 - Michael Ströder <michael@stroeder.com>
|
||
|
||
- updated to 2.4.35:
|
||
* http: Enforce consistently no response body with both 204 and 304
|
||
statuses.
|
||
* mod_status: Cumulate CPU time of exited child processes in the
|
||
"cu" and "cs" values. Add CPU time of the parent process to the
|
||
"c" and "s" values.
|
||
* mod_proxy: Improve the balancer member data shown in mod_status when
|
||
"ProxyStatus" is "On": add "busy" count and show byte counts in
|
||
auto mode always in units of kilobytes.
|
||
* mod_status: Add cumulated response duration time in milliseconds.
|
||
* mod_status: Complete the data shown for async MPMs in "auto" mode.
|
||
Added number of processes, number of stopping processes and number
|
||
of busy and idle workers.
|
||
* mod_ratelimit: Don't interfere with "chunked" encoding, fixing regression
|
||
introduced in 2.4.34. PR 62568.
|
||
* mod_proxy: Remove load order and link dependency between mod_lbmethod_*
|
||
modules and mod_proxy. PR 62557.
|
||
* Allow the argument to <IfFile>, <IfDefine>, <IfSection>, <IfDirective>,
|
||
and <IfModule> to be quoted. This is primarily for the benefit of
|
||
<IfFile>.
|
||
* mod_watchdog: Correct some log messages.
|
||
* mod_md: When the last domain name from an MD is moved to another one,
|
||
that now empty MD gets moved to the store archive. PR 62572.
|
||
* mod_ssl: Fix merging of SSLOCSPOverrideResponder.
|
||
* mod_proxy_balancer: Restore compatibility with APR 1.4.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 16 12:03:39 UTC 2018 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.34:
|
||
*) Introduce zh-cn and zh-tw (simplified and traditional Chinese) error
|
||
document translations. [CodeingBoy, popcorner]
|
||
*) event: avoid possible race conditions with modules on the child pool.
|
||
[Stefan Fritsch]
|
||
*) mod_proxy: Fix a corner case where the ProxyPassReverseCookieDomain or
|
||
ProxyPassReverseCookiePath directive could fail to update correctly
|
||
'domain=' or 'path=' in the 'Set-Cookie' header. PR 61560.
|
||
[Christophe Jaillet]
|
||
*) mod_ratelimit: fix behavior when proxing content. PR 62362.
|
||
[Luca Toscano, Yann Ylavic]
|
||
*) core: Re-allow '_' (underscore) in hostnames.
|
||
[Eric Covener]
|
||
*) mod_authz_core: If several parameters are used in a AuthzProviderAlias
|
||
directive, if these parameters are not enclosed in quotation mark, only
|
||
the first one is handled. The other ones are silently ignored.
|
||
Add a message to warn about such a spurious configuration.
|
||
PR 62469 [Hank Ibell <hwibell gmail.com>, Christophe Jaillet]
|
||
*) mod_md: improvements and bugfixes
|
||
- MDNotifyCmd now takes additional parameter that are passed on to the called command.
|
||
- ACME challenges have better checks for interference with other modules
|
||
- ACME challenges are only handled for domains managed by the module, allowing
|
||
other ACME clients to operate for other domains in the server.
|
||
- better libressl integration
|
||
*) mod_proxy_wstunnel: Add default schema ports for 'ws' and 'wss'.
|
||
PR 62480. [Lubos Uhliarik <luhliari redhat.com>}
|
||
*) logging: Some early logging-related startup messages could be lost
|
||
when using syslog for the global ErrorLog. [Eric Covener]
|
||
*) mod_cache: Handle case of an invalid Expires header value RFC compliant
|
||
like the case of an Expires time in the past: allow to overwrite the
|
||
non-caching decision using CacheStoreExpired and respect Cache-Control
|
||
"max-age" and "s-maxage". [Rainer Jung]
|
||
*) mod_xml2enc: Fix forwarding of error metadata/responses. PR 62180.
|
||
[Micha Lenk <micha lenk.info>, Yann Ylavic]
|
||
*) mod_proxy_http: Fix response header thrown away after the previous one
|
||
was considered too large and truncated. PR 62196. [Yann Ylavic]
|
||
*) core: Add and handle AP_GETLINE_NOSPC_EOL flag for ap_getline() family
|
||
of functions to consume the end of line when the buffer is exhausted.
|
||
PR 62198. [Yann Ylavic]
|
||
*) mod_proxy_http: Add new worker parameter 'responsefieldsize' to
|
||
allow maximum HTTP response header size to be increased past 8192
|
||
bytes. PR 62199. [Hank Ibell <hwibell gmail.com>]
|
||
*) mod_ssl: Extend SSLOCSPEnable with mode 'leaf' that only checks the leaf
|
||
of a certificate chain. PR62112.
|
||
[Ricardo Martin Camarero <rickyepoderi yahoo.es>]
|
||
*) http: Fix small memory leak per request when handling persistent
|
||
connections. [Ruediger Pluem, Joe Orton]
|
||
*) mod_proxy_html: Fix variable interpolation and memory allocation failure
|
||
in ProxyHTMLURLMap. [Ewald Dieterich <ewald mailbox.org>]
|
||
*) mod_remoteip: Fix RemoteIP{Trusted,Internal}ProxyList loading broken by 2.4.30.
|
||
PR 62220. [Chritophe Jaillet, Yann Ylavic]
|
||
*) mod_remoteip: When overriding the useragent address from X-Forwarded-For,
|
||
zero out what had been initialized as the connection-level port. PR59931.
|
||
[Hank Ibell <hwibell gmail.com>]
|
||
*) core: In ONE_PROCESS/debug mode, cleanup everything when exiting.
|
||
[Yann Ylavic]
|
||
*) mod_proxy_balancer: Add hot spare member type and corresponding flag (R).
|
||
Hot spare members are used as drop-in replacements for unusable workers
|
||
in the same load balancer set. This differs from hot standbys which are
|
||
only used when all workers in a set are unusable. PR 61140. [Jim Riggs]
|
||
*) suexec: Add --enable-suexec-capabilites support on Linux, to use
|
||
setuid/setgid capability bits rather than a setuid root binary.
|
||
[Joe Orton]
|
||
*) suexec: Add support for logging to syslog as an alternative to
|
||
logging to a file; use --without-suexec-logfile --with-suexec-syslog.
|
||
[Joe Orton]
|
||
*) mod_ssl: Restore 2.4.29 behaviour in SSL vhost merging/enabling
|
||
which broke some rare but previously-working configs. [Joe Orton]
|
||
*) core, log: improve sanity checks for the ErrorLog's syslog config, and
|
||
explicitly allow only lowercase 'syslog' settings. PR 62102
|
||
[Luca Toscano, Jim Riggs, Christophe Jaillet]
|
||
*) mod_http2: accurate reporting of h2 data input/output per request via
|
||
mod_logio. Fixes an issue where output sizes where counted n-times on
|
||
reused slave connections. [Stefan Eissing]
|
||
See github issue: https://github.com/icing/mod_h2/issues/158
|
||
*) mod_http2: Fix unnecessary timeout waits in case streams are aborted.
|
||
[Stefan Eissing]
|
||
*) mod_http2: restoring the v1.10.16 keepalive timeout behaviour of mod_http2.
|
||
[Stefan Eissing]
|
||
*) mod_proxy: Do not restrict the maximum pool size for backend connections
|
||
any longer by the maximum number of threads per process and use a better
|
||
default if mod_http2 is loaded.
|
||
[Yann Ylavic, Ruediger Pluem, Stefan Eissing, Gregg Smith]
|
||
*) mod_slotmem_shm: Add generation number to shm filename to fix races
|
||
with graceful restarts. PRs 62044 and 62308. [Jim Jagielski, Yann Ylavic]
|
||
*) core: Preserve the original HTTP request method in the '%<m' LogFormat
|
||
when an path-based ErrorDocument is used. PR 62186.
|
||
[Micha Lenk <micha lenk.info>]
|
||
*) mod_remoteip: make proxy-protocol work on slave connections, e.g. in
|
||
HTTP/2 requests. [Stefan Eissing]
|
||
See also https://github.com/roadrunner2/mod-proxy-protocol/issues/6
|
||
*) mod_ssl: Fix merging of proxy SSL context outside <Proxy> sections,
|
||
regression introduced in 2.4.30. PR 62232. [Rainer Jung, Yann Ylavic]
|
||
*) mod_md: Fix compilation with OpenSSL before version 1.0.2. [Rainer Jung]
|
||
*) mod_dumpio: do nothing below log level TRACE7. [Yann Ylavic]
|
||
*) mod_remoteip: Restore compatibility with APR 1.4 (apr_sockaddr_is_wildcard).
|
||
[Eric Covener]
|
||
*) core: On ECBDIC platforms, some errors related to oversized headers
|
||
may be misreported or be logged as ASCII escapes. PR 62200
|
||
[Hank Ibell <hwibell gmail.com>]
|
||
*) mod_ssl: Fix cmake-based build. PR 62266. [Rainer Jung]
|
||
*) core: Add <IfFile>, <IfDirective> and <IfSection> conditional
|
||
section containers. [Eric Covener, Joe Orton]
|
||
* %check: do not load all modules, just use default loadmodule.conf; some
|
||
modules require to load another ones in advance
|
||
* %install: parallel install is broken
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 27 15:22:00 UTC 2018 - mikhail.kasimov@gmail.com
|
||
|
||
- Updated description for SSLProtocol option. [bsc#1086854]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 27 14:19:00 UTC 2018 - mikhail.kasimov@gmail.com
|
||
|
||
- Updated description (PCI DSS) for SSLProtocol option. [bsc#1086854]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 26 14:16:14 UTC 2018 - pgajdos@suse.com
|
||
|
||
- SSLProtocol TLSv1.2 [bsc#1086854]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 19 09:15:28 UTC 2018 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.33:
|
||
*) core: Fix request timeout logging and possible crash for error_log hooks.
|
||
[Yann Ylavic]
|
||
*) mod_slomem_shm: Fix failure to create balancers's slotmems in Windows MPM,
|
||
where children processes need to attach them instead since they are owned
|
||
by the parent process already. [Yann Ylavic]
|
||
*) ab: try all destination socket addresses returned by
|
||
apr_sockaddr_info_get instead of failing on first one when not available.
|
||
Needed for instance if localhost resolves to both ::1 and 127.0.0.1
|
||
e.g. if both are in /etc/hosts. [Jan Kaluza]
|
||
*) ab: Use only one connection to determine working destination socket
|
||
address. [Jan Kaluza]
|
||
*) ab: LibreSSL doesn't have or require Windows applink.c. [Gregg L. Smith]
|
||
*) htpasswd/htdigest: Disable support for bcrypt on EBCDIC platforms.
|
||
apr-util's bcrypt implementation doesn't tolerate EBCDIC. [Eric Covener]
|
||
*) htpasswd/htdbm: report the right limit when get_password() overflows.
|
||
[Yann Ylavic]
|
||
*) htpasswd: Don't fail in -v mode if password file is unwritable.
|
||
PR 61631. [Joe Orton]
|
||
*) htpasswd: don't point to (unused) stack memory on output
|
||
to make static analysers happy. PR 60634.
|
||
[Yann Ylavic, reported by shqking and Zhenwei Zou]
|
||
*) mod_access_compat: Fail if a comment is found in an Allow or Deny
|
||
directive. [Jan Kaluza]
|
||
*) mod_authz_host: Ignore comments after "Require host", logging a
|
||
warning, or logging an error if the line is otherwise empty.
|
||
[Jan Kaluza, Joe Orton]
|
||
*) rotatelogs: Fix expansion of %Z in localtime (-l) mode, and fix
|
||
Y2K38 bug. [Joe Orton]
|
||
*) mod_ssl: Support SSL DN raw variable extraction without conversion
|
||
to UTF-8, using _RAW suffix on variable names. [Joe Orton]
|
||
*) ab: Fix https:// connection failures (regression in 2.4.30); fix
|
||
crash generating CSV output for large -n. [Joe Orton, Jan Kaluza]
|
||
*) mod_proxy_fcgi: Add the support for mod_proxy's flushpackets and flushwait
|
||
parameters. [Luca Toscano, Ruediger Pluem, Yann Ylavic]
|
||
*) mod_ldap: Avoid possible crashes, hangs, and busy loops due to
|
||
improper merging of the cache lock in vhost config.
|
||
PR 43164 [Eric Covener]
|
||
*) mpm_event: Do lingering close in worker(s). [Yann Ylavic]
|
||
*) mpm_queue: Put fdqueue code in common for MPMs event and worker.
|
||
[Yann Ylavic]
|
||
*) mod_session: Strip Session header when SessionEnv is on. [Yann Ylavic]
|
||
*) mod_cache_socache: Fix caching of empty headers up to carriage return.
|
||
[Yann Ylavic]
|
||
*) core: For consistency, ensure that read lines are NUL terminated on any
|
||
error, not only on buffer full. [Yann Ylavic]
|
||
*) mod_authnz_ldap: Fix language long names detection as short name.
|
||
[Yann Ylavic]
|
||
*) mod_proxy: Worker schemes and hostnames which are too large are no
|
||
longer fatal errors; it is logged and the truncated values are stored.
|
||
[Jim Jagielski]
|
||
*) regex: Allow to configure global/default options for regexes, like
|
||
caseless matching or extended format. [Yann Ylavic]
|
||
*) mod_auth_digest: Actually use the secret when generating nonces. This change
|
||
may cause problems if used with round robin load balancers. PR 54637
|
||
[Stefan Fritsch]
|
||
*) mod_proxy: Allow setting options to globally defined balancer from
|
||
ProxyPass used in VirtualHost. Balancers are now merged using the new
|
||
merge_balancers method which merges the balancers options. [Jan Kaluza]
|
||
*) logresolve: Fix incorrect behavior or segfault if -c flag is used
|
||
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823259
|
||
[Stefan Fritsch]
|
||
*) mod_remoteip: Add support for PROXY protocol (code donated by Cloudzilla).
|
||
Add ability for PROXY protocol processing to be optional to donated code.
|
||
See also: http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt
|
||
[Cloudzilla/roadrunner2@GitHub, Jim Jagielski, Daniel Ruggeri]
|
||
*) mod_proxy, mod_ssl: Handle SSLProxy* directives in <Proxy> sections,
|
||
allowing per backend TLS configuration. [Yann Ylavic]
|
||
*) mod_proxy_uwsgi: Add in UWSGI proxy (sub)module. [Roberto De Ioris,
|
||
Jim Jagielski]
|
||
*) mod_proxy_balancer,mod_slotmem_shm: Rework SHM reuse/deletion to not
|
||
depend on the number of restarts (non-Unix systems) and preserve shared
|
||
names as much as possible on configuration changes for SHMs and persisted
|
||
files. PR 62044. [Yann Ylavic, Jim Jagielski]
|
||
*) mod_http2: obsolete code removed, no more events on beam pool destruction,
|
||
discourage content encoders on http2-status response (where they do not work).
|
||
[Stefan Eissing]
|
||
*) mpm_event: Let the listener thread do its maintenance job on resources
|
||
shortage. PR 61979. [Yann Ylavic]
|
||
*) mpm_event: Wakeup the listener to re-enable listening sockets.
|
||
[Yann Ylavic]
|
||
*) mod_ssl: The SSLCompression directive will now give an error if used
|
||
with an OpenSSL build which does not support any compression methods.
|
||
[Joe Orton]
|
||
*) mpm_event,worker: Mask signals for threads created by modules in child
|
||
init, so that they don't receive (implicitely) the ones meant for the MPM.
|
||
PR 62009. [Armin Abfalterer <a.abfalterer gmail com>, Yann Ylavic]
|
||
*) mod_md: new experimental, module for managing domains across virtual hosts,
|
||
implementing the Let's Encrypt ACMEv1 protocol to signup and renew
|
||
certificates. Please read the modules documentation for further instructions
|
||
on how to use it. [Stefan Eissing]
|
||
*) mod_proxy_html: skip documents shorter than 4 bytes
|
||
PR 56286 [Micha Lenk <micha lenk info>]
|
||
*) core, mpm_event: Avoid a small memory leak of the scoreboard handle, for
|
||
the lifetime of the connection, each time it is processed by MPM event.
|
||
[Yann Ylavic]
|
||
*) mpm_event: Update scoreboard status for KeepAlive state. [Yann Ylavic]
|
||
*) mod_ldap: Fix a case where a full LDAP cache would continually fail to
|
||
purge old entries and log AH01323. PR61891.
|
||
[Hendrik Harms <hendrik.harms gmail.com>]
|
||
*) mpm_event: close connections not reported as handled by any module to
|
||
avoid losing track of them and leaking scoreboard entries. PR 61551.
|
||
[Yann Ylavic]
|
||
*) core: A signal received while stopping could have crashed the main
|
||
process. PR 61558. [Yann Ylavic]
|
||
*) mod_ssl: support for mod_md added. [Stefan Eissing]
|
||
*) mod_proxy_html: process parsed comments immediately.
|
||
Fixes bug (seen in the wild when used with IBM's HTTPD bundle)
|
||
where parsed comments may be lost. [Nick Kew]
|
||
*) mod_proxy_html: introduce doctype for HTML 5 [Nick Kew]
|
||
*) mod_proxy_html: fix typo-bug processing "strict" vs "transitional"
|
||
HTML/XHTML. PR 56457 [Nick Kew]
|
||
*) mpm_event: avoid a very unlikely race condition between the listener and
|
||
the workers when the latter fails to add a connection to the pollset.
|
||
[Yann Ylavic]
|
||
*) core: silently ignore a not existent file path when IncludeOptional
|
||
is used. PR 57585. [Alberto Murillo Silva <powerbsd yahoo.com>, Luca Toscano]
|
||
*) mod_macro: fix usability of globally defined macros in .htaccess files.
|
||
PR 57525. [Jose Kahan <jose w3.org>, Yann Ylavic]
|
||
*) mod_rewrite, core: add the Vary header when a condition evaluates to true
|
||
and the related RewriteRule is used in a Directory context
|
||
(triggering an internal redirect). [Luca Toscano]
|
||
*) ab: Make the TLS layer aware that the underlying socket is nonblocking,
|
||
and use/handle POLLOUT where needed to avoid busy IOs and recover write
|
||
errors when appropriate. [Yann Ylavic]
|
||
*) ab: Keep reading nonblocking to exhaust TCP or SSL buffers when previous
|
||
read was incomplete (the SSL case can cause the next poll() to timeout
|
||
since data are buffered already). PR 61301 [Luca Toscano, Yann Ylavic]
|
||
*) mod_http2: avoid unnecessary data retrieval for a trace log. Allow certain
|
||
information retrievals on null bucket beams where it makes sense. [Stefan Eissing]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 19 07:53:04 UTC 2018 - pgajdos@suse.com
|
||
|
||
- Replace SuSEFirewall2 by firewalld II (fate#323460) [bsc#1083492]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 5 07:14:03 UTC 2018 - pgajdos@suse.com
|
||
|
||
- build mod_http2 also for 42.3
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 2 07:39:23 UTC 2018 - pgajdos@suse.com
|
||
|
||
- remove NameVirtualHost from documentation [bsc#1078557]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 30 09:16:26 UTC 2018 - pgajdos@suse.com
|
||
|
||
- for older distros, still use SuSEFirewall2 [bsc#1071548c#7]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 29 09:23:46 UTC 2018 - knut.anderssen@suse.com
|
||
|
||
- Replace SuSEFirewall2 by firewalld (fate#323460)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 20 16:18:56 UTC 2017 - pgajdos@suse.com
|
||
|
||
- build brotli module
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 20 13:17:46 UTC 2017 - fcrozat@suse.com
|
||
|
||
- Do not requires w3m, only recommends it.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Dec 19 09:47:13 UTC 2017 - pgajdos@suse.com
|
||
|
||
- do not build with nghttp2 for SLE-12-SP3
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 15 13:05:29 UTC 2017 - pgajdos@suse.com
|
||
|
||
- which was split after SLE11
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Nov 26 17:25:10 UTC 2017 - sergiolindo.empresa@gmail.com
|
||
|
||
- Add which and w3m as dependencies. poo#28406
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 23 13:43:30 UTC 2017 - rbrown@suse.com
|
||
|
||
- Replace references to /var/adm/fillup-templates with new
|
||
%_fillupdir macro (boo#1069468)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 20 08:43:45 UTC 2017 - pgajdos@suse.com
|
||
|
||
- APACHE_MODULES now contains authn_core in default configuration
|
||
[bsc#1066661]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 18 09:22:41 UTC 2017 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.29:
|
||
*) mod_unique_id: Use output of the PRNG rather than IP address and
|
||
pid, avoiding sleep() call and possible DNS issues at startup,
|
||
plus improving randomness for IPv6-only hosts. [Jan Kaluza]
|
||
*) mod_rewrite, core: Avoid the 'Vary: Host' response header when HTTP_HOST
|
||
is used in a condition that evaluates to true. PR 58231 [Luca Toscano]
|
||
*) mod_http2: v0.10.12, removed optimization for mutex handling in bucket
|
||
beams that could lead to assertion failure in edge cases.
|
||
[Stefan Eissing]
|
||
*) mod_proxy: Fix regression for non decimal loadfactor parameter introduced
|
||
in 2.4.28. [Jim Jagielski]
|
||
*) mod_authz_dbd: fix a segmentation fault if AuthzDBDQuery is not set.
|
||
PR 61546. [Lubos Uhliarik <luhliari redhat.com>]
|
||
*) mod_rewrite: Add support for starting External Rewriting Programs
|
||
as non-root user on UNIX systems by specifying username and group
|
||
name as third argument of RewriteMap directive. [Jan Kaluza]
|
||
*) core: Rewrite the Content-Length filter to avoid excessive memory
|
||
consumption. Chunked responses will be generated in more cases
|
||
than in previous releases. PR 61222. [Joe Orton, Ruediger Pluem]
|
||
*) mod_ssl: Fix SessionTicket callback return value, which does seem to
|
||
matter with OpenSSL 1.1. [Yann Ylavic]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 17 12:41:23 UTC 2017 - pgajdos@suse.com
|
||
|
||
- gensslcert:
|
||
* set also SAN [bsc#1045159]
|
||
* drop -C argument, it was not mapped to CN actually
|
||
* consider also case when hostname does return empty string or
|
||
does not exist [bsc#1057406]
|
||
* do not consider environment ROOT variable
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 6 07:45:55 UTC 2017 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.28:
|
||
*) SECURITY: CVE-2017-9798 (cve.mitre.org)
|
||
Corrupted or freed memory access. <Limit[Except]> must now be used in the
|
||
main configuration file (httpd.conf) to register HTTP methods before the
|
||
.htaccess files. [Yann Ylavic]
|
||
*) event: Avoid possible blocking in the listener thread when shutting down
|
||
connections. PR 60956. [Yann Ylavic]
|
||
*) mod_speling: Don't embed referer data in a link in error page.
|
||
PR 38923 [Nick Kew]
|
||
*) htdigest: prevent a buffer overflow when a string exceeds the allowed max
|
||
length in a password file.
|
||
[Luca Toscano, Hanno Böck <hanno hboeck de>]
|
||
*) mod_proxy: loadfactor parameter can now be a decimal number (eg: 1.25).
|
||
[Jim Jagielski]
|
||
*) mod_proxy_wstunnel: Allow upgrade to any protocol dynamically.
|
||
PR 61142.
|
||
*) mod_watchdog/mod_proxy_hcheck: Time intervals can now be spefified
|
||
down to the millisecond. Supports 'mi' (minute), 'ms' (millisecond),
|
||
's' (second) and 'hr' (hour!) time suffixes. [Jim Jagielski]
|
||
*) mod_http2: Fix for stalling when more than 32KB are written to a
|
||
suspended stream. [Stefan Eissing]
|
||
*) build: allow configuration without APR sources. [Jacob Champion]
|
||
*) mod_ssl, ab: Fix compatibility with LibreSSL. PR 61184.
|
||
[Bernard Spil <brnrd freebsd.org>, Michael Schlenker <msc contact.de>,
|
||
Yann Ylavic]
|
||
*) core/log: Support use of optional "tag" in syslog entries.
|
||
PR 60525. [Ben Rubson <ben.rubson gmail.com>, Jim Jagielski]
|
||
*) mod_proxy: Fix ProxyAddHeaders merging. [Joe Orton]
|
||
*) core: Disallow multiple Listen on the same IP:port when listener buckets
|
||
are configured (ListenCoresBucketsRatio > 0), consistently with the single
|
||
bucket case (default), thus avoiding the leak of the corresponding socket
|
||
descriptors on graceful restart. [Yann Ylavic]
|
||
*) event: Avoid listener periodic wake ups by using the pollset wake-ability
|
||
when available. PR 57399. [Yann Ylavic, Luca Toscano]
|
||
*) mod_proxy_wstunnel: Fix detection of unresponded request which could have
|
||
led to spurious HTTP 502 error messages sent on upgrade connections.
|
||
PR 61283. [Yann Ylavic]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 5 12:57:56 UTC 2017 - pgajdos@suse.com
|
||
|
||
- suexec binary moved to main package [bsc#1054741]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 3 16:13:13 UTC 2017 - pgajdos@suse.com
|
||
|
||
- do not call and do not ship apache-22-24-upgrade [bsc#1042037]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 24 15:25:09 UTC 2017 - schneemann@b1-systems.de
|
||
|
||
- make the package runable on non systemd systems
|
||
+ deprecated-scripts-arch.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 17 09:30:36 UTC 2017 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.27:
|
||
*) COMPATIBILITY: mod_lua: Remove the undocumented exported 'apr_table'
|
||
global variable when using Lua 5.2 or later. This was exported as a
|
||
side effect from luaL_register, which is no longer supported as of
|
||
Lua 5.2 which deprecates pollution of the global namespace.
|
||
[Rainer Jung]
|
||
*) COMPATIBILITY: mod_http2: Disable and give warning when using Prefork.
|
||
The server will continue to run, but HTTP/2 will no longer be negotiated.
|
||
[Stefan Eissing]
|
||
*) COMPATIBILITY: mod_proxy_fcgi: Revert to 2.4.20 FCGI behavior for the
|
||
default ProxyFCGIBackendType, fixing a regression with PHP-FPM. PR 61202.
|
||
[Jacob Champion, Jim Jagielski]
|
||
*) mod_lua: Improve compatibility with Lua 5.1, 5.2 and 5.3.
|
||
PR58188, PR60831, PR61245. [Rainer Jung]
|
||
*) mod_http2: Simplify ready queue, less memory and better performance. Update
|
||
mod_http2 version to 1.10.7. [Stefan Eissing]
|
||
*) Allow single-char field names inadvertantly disallowed in 2.4.25.
|
||
PR 61220. [Yann Ylavic]
|
||
*) htpasswd / htdigest: Do not apply the strict permissions of the temporary
|
||
passwd file to a possibly existing passwd file. PR 61240. [Ruediger Pluem]
|
||
*) core: Avoid duplicate HEAD in Allow header.
|
||
This is a regression in 2.4.24 (unreleased), 2.4.25 and 2.4.26.
|
||
PR 61207. [Christophe Jaillet]
|
||
- drop upstreamed patch:
|
||
* httpd-2.4.12-lua-5.2.patch (see upstream's PR#58188 for details)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 12 06:37:57 UTC 2017 - mpluskal@suse.com
|
||
|
||
- Adjust dependencies for rename apr/apr-util packages
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 20 13:57:18 UTC 2017 - pgajdos@suse.com
|
||
|
||
- remove /usr/bin/http2 symlink only during apache2 package
|
||
uninstall, not upgrade [bsc#1041830]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jun 19 08:15:40 UTC 2017 - pgajdos@suse.com
|
||
|
||
- updated to 2.4.26: This release of Apache is a security, feature,
|
||
and bug fix release. For details, see
|
||
http://httpd.apache.org/dev/dist/CHANGES_2.4.26
|
||
- refreshed patches:
|
||
. httpd-2.4.12-lua-5.2.patch
|
||
. httpd-2.4.x-fate317766-config-control-two-protocol-options.diff
|
||
- removed patches (upstreamed)
|
||
. httpd-cache-forward-http-proxy.patch
|
||
. httpd-cache-revert-svn1773397.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 2 07:36:43 UTC 2017 - pgajdos@suse.com
|
||
|
||
- server-tunning.conf: MaxClients was renamed to MaxRequestWorkers
|
||
[bsc#1037731]
|
||
- gensslcert: use hostname when fqdn is too long [bsc#1035829]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri May 19 09:01:33 UTC 2017 - pgajdos@suse.com
|
||
|
||
- remove apache-doc and apache-example-pages obsoletes/provides
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 16 18:59:58 UTC 2017 - kukuk@suse.com
|
||
|
||
- PreRequire user wwwrun and group www
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 7 15:14:29 UTC 2017 - pgajdos@suse.com
|
||
|
||
- start_apache2: include individual sysconfig.d files instead of
|
||
sysconfig.d dir, include sysconfig.d/include.conf after httpd.conf
|
||
is processed [bsc#1023616]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 23 14:12:48 UTC 2017 - pgajdos@suse.com
|
||
|
||
- revert an attempt to fix PR 60458
|
||
+ httpd-cache-revert-svn1773397.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 21 07:22:19 UTC 2017 - pgajdos@suse.com
|
||
|
||
- fix caching of forward proxy
|
||
+ httpd-cache-forward-http-proxy.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Feb 18 17:49:58 UTC 2017 - kukuk@suse.com
|
||
|
||
- Don't require insserv if we don't need it.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 10 22:00:14 UTC 2017 - jweberhofer@weberhofer.at
|
||
|
||
- Added new HTTP2 option to sysconfig to ease enabling http2
|
||
- Added new protocols.conf which is included globally
|
||
- Enable http2 also for Leap 42.2+ and SLE12_SP2+
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 2 09:50:00 UTC 2017 - pgajdos@suse.com
|
||
|
||
- update to 2.4.25: fixed several security issues (CVE-2016-8740,
|
||
CVE-2016-5387, CVE-2016-2161, CVE-2016-0736, CVE-2016-8743), many
|
||
fixes and improvements of mod_http2 and other modules; see CHANGES
|
||
for full change log
|
||
- verify tarball: added httpd*.bz2.asc, apache2.keyring and remove
|
||
60C5442D.key
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 9 12:21:27 UTC 2016 - pgajdos@suse.com
|
||
|
||
- fix build with new systemd
|
||
+ amended httpd-2.4.3-mod_systemd.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 2 20:53:50 UTC 2016 - jimmy@boombatower.com
|
||
|
||
- Replace mixed indentation with predominant style.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 13 06:39:50 UTC 2016 - pgajdos@suse.com
|
||
|
||
- add NotifyAccess=all to service file [bsc#980663]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 5 11:36:28 UTC 2016 - tchvatal@suse.com
|
||
|
||
- Remove the omc xml config. It is useless nowdays
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 5 09:15:11 UTC 2016 - pgajdos@suse.com
|
||
|
||
- readd the support of multiple entries in APACHE_ACCESS_LOG
|
||
[bsc#991032]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jul 12 14:49:09 UTC 2016 - kstreitova@suse.com
|
||
|
||
- add httpd-2.4.x-fate317766-config-control-two-protocol-options.diff
|
||
Introduces directives to control two protocol options:
|
||
* HttpContentLengthHeadZero - allow Content-Length of 0 to be
|
||
returned on HEAD
|
||
* HttpExpectStrict - allow admin to control whether we must
|
||
see "100-continue"
|
||
[bsc#894225], [fate#317766]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 6 16:16:57 UTC 2016 - crrodriguez@opensuse.org
|
||
|
||
- version 2.4.23
|
||
* Fixes CVE-2016-4979 [bsc#987365]
|
||
* mod_proxy_hcheck was missing due to upstream bug.
|
||
* mod_proxy_fdpass needs explicit configure line now.
|
||
* Full list of changes:
|
||
http://www-eu.apache.org/dist//httpd/CHANGES_2.4.23
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 6 06:29:57 UTC 2016 - fbui@suse.com
|
||
|
||
- Remove pkgconfig(libsystemd-daemon). Nowadays pkgconfig(libsystemd)
|
||
is enough and replaces all libsystemd-* libs which are obsolete.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu May 26 08:13:16 UTC 2016 - pgajdos@suse.com
|
||
|
||
- remove Alias= from [Install] of the template service
|
||
[bsc#981541c#10]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 18 06:30:34 UTC 2016 - pgajdos@suse.com
|
||
|
||
- remove unneded httpd-2.4.17-debug-crash.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 9 13:57:54 UTC 2016 - pgajdos@suse.com
|
||
|
||
- start apache services after remote-fs [bsc#978543]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu May 5 07:06:05 UTC 2016 - pgajdos@suse.com
|
||
|
||
- removed note about ulimits in sysconfig file [bsc#976711]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 2 07:48:44 UTC 2016 - pgajdos@suse.com
|
||
|
||
- do not build mod_http2 for 13.2
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 11 04:43:21 UTC 2016 - crrodriguez@opensuse.org
|
||
|
||
- Update to version 2.4.20 (2.4.19 was never released)
|
||
* Drop httpd-2.4.18-missing-semicolon.patch now upstream
|
||
- Big changelog available, see:
|
||
http://www.apache.org/dist/httpd/CHANGES_2.4.20 for details.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 4 11:19:14 UTC 2016 - pgajdos@suse.com
|
||
|
||
- enable authnz_fcgi module
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 14 16:44:55 UTC 2015 - pgajdos@suse.com
|
||
|
||
- fix build for SLE_11_SP4:
|
||
+ httpd-2.4.18-missing-semicolon.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 12 15:57:21 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- Update to version 2.4.18
|
||
* drop 2.4.17-protocols.patch in upstream.
|
||
- Change list too long to mention here see:
|
||
http://www.apache.org/dist/httpd/CHANGES_2.4.18 for details.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 7 18:05:37 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- systemd: Set TasksMax=infinity for current systemd releases.
|
||
The default limit of 512 is too small and prevents the creation of
|
||
new server processes. Apache has its own runtime/harcoded limits.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 3 10:00:28 UTC 2015 - pgajdos@suse.com
|
||
|
||
- fix crash when for -X
|
||
+ httpd-2.4.17-debug-crash.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 23 11:02:19 UTC 2015 - pgajdos@suse.com
|
||
|
||
- add a note: FollowSymLinks or SymLinksIfOwnerMatch is neccessary
|
||
for RewriteRule in given dir [bnc#955701]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 6 10:06:19 UTC 2015 - pgajdos@suse.com
|
||
|
||
- restart apache once after the rpm or zypper transaction
|
||
[bnc#893659]
|
||
- drop some old compat code from %post
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 5 16:52:45 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- 2.4.17-protocols.patch from upstream http2 module:
|
||
* master conn_rec* addition to conn_rec
|
||
* improved ALPN and Upgrade handling
|
||
* allowing requests for servers whose TLS configuration is compatible
|
||
to the SNI server ones
|
||
* disabling TLS renegotiation for slave connections
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Nov 4 06:29:27 UTC 2015 - pgajdos@suse.com
|
||
|
||
- LogLevel directive into correct config file, thanks Michael Calmer
|
||
for the fix [bsc#953329]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 26 09:34:28 UTC 2015 - pgajdos@suse.com
|
||
|
||
- do not build mod_http2 for older distros than 13.2 for now (nghttp2
|
||
does not build there)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 26 09:14:29 UTC 2015 - pgajdos@suse.com
|
||
|
||
- Include directives really into /etc/apache2/sysconfig.d/include.conf,
|
||
fix from Erik Wegner [bsc#951901]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 21 07:35:30 UTC 2015 - pgajdos@suse.com
|
||
|
||
- gensslcert: CN now defaults to `hostname -f` [bnc#949766]
|
||
(internal), fix help [bnc#949771] (internal)
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Oct 18 03:47:09 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- Update to 2.4.17
|
||
- Enable mod_http2/ BuildRequire nghttp2
|
||
- MPMs: Support SO_REUSEPORT to create multiple duplicated listener
|
||
records for scalability
|
||
- mod_ssl: Support compilation against libssl built with OPENSSL_NO_SSL3
|
||
- For more changes see: http://www.apache.org/dist/httpd/CHANGES_2.4.17
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 12 09:00:27 UTC 2015 - pgajdos@suse.com
|
||
|
||
- start_apache2: reintroduce sysconfig.d, include it on
|
||
command line (not in httpd.conf) instead of individual directives
|
||
[bnc#949434] (internal), [bnc#941331]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 13 13:04:00 UTC 2015 - schwab@suse.de
|
||
|
||
- Fixup libdir in installed files
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
|
||
|
||
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
|
||
disable export cipher suites and deploy Ephemeral Elliptic-Curve
|
||
Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
|
||
generate a strong and unique Diffie Hellman Group and append it
|
||
to the server certificate file [bnc#931723], [CVE-2015-4000]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 29 06:22:59 UTC 2015 - pgajdos@suse.com
|
||
|
||
- add reference upstream bug#58188 along httpd-2.4.12-lua-5.2.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 20 13:35:21 UTC 2015 - kstreitova@suse.com
|
||
|
||
- update to 2.4.16
|
||
* changes http://www.apache.org/dist/httpd/CHANGES_2.4.16
|
||
* remove the following patches (fixed in 2.4.16)
|
||
* httpd-2.4.x-mod_lua_websocket_DoS.patch
|
||
* httpd-2.4.12-CVE-2015-0253.patch
|
||
* update httpd-2.4.12-lua-5.2.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jul 18 03:50:24 UTC 2015 - i@marguerite.su
|
||
|
||
- add patch: httpd-2.4.12-lua-5.2.patch
|
||
* lua_dump introduced a new strip option in 5.3, set it to 0
|
||
to get the old behavior
|
||
* luaL_register was deprecated in 5.2, use luaL_setfuncs and
|
||
luaL_newlib instead
|
||
* luaL_optint was deprecated in 5.3, use luaL_optinteger instead
|
||
* lua_strlen and lua_objlen wad deprecated in 5.2, use lua_rawlen
|
||
instead
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jul 16 08:46:22 UTC 2015 - pgajdos@suse.com
|
||
|
||
- change Provides: from suse_maintenance_mmn = # to
|
||
suse_maintenance_mmn_#
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 15 14:47:33 UTC 2015 - pgajdos@suse.com
|
||
|
||
- apache2 Suggests:, not Recommends: apache2-prefork; that means
|
||
for example, that `zypper in apache2-worker` will not pull
|
||
apache2-prefork also
|
||
- installing /usr/sbin/httpd link:
|
||
* do not try to install it in '%post <MPM>' when apache2 (which
|
||
includes /usr/share/apache2/script-helpers) is not installed
|
||
yet (fixes installation on 11sp3)
|
||
* install it in '%post' if apache2 is installed after
|
||
apache2-<MPM> to be sure it is there
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jul 14 07:32:00 UTC 2015 - pgajdos@suse.com
|
||
|
||
- access_compat shared also for 11sp3
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 15:14:20 UTC 2015 - pgajdos@suse.com
|
||
|
||
- apache2-implicit-pointer-decl.patch renamed to
|
||
httpd-implicit-pointer-decl.patch to align with other
|
||
patches names
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 15:12:29 UTC 2015 - pgajdos@suse.com
|
||
|
||
- apachectl is now wrapper to start_apache2; therefore, it honors
|
||
HTTPD_INSTANCE variable, see README-instances.txt for details
|
||
+ httpd-apachectl.patch
|
||
- httpd-2.4.10-apachectl.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 13:37:53 UTC 2015 - pgajdos@suse.com
|
||
|
||
- a2enmod/a2dismod and a2enflag/a2disflag now respect
|
||
HTTPD_INSTANCE=<instance_name> environment variable, which can be
|
||
used to specify apache instance name; sysconfig file is expected
|
||
at /etc/sysconfig/apache2@<instance_name>
|
||
(see README-instances.txt for details)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 11:21:43 UTC 2015 - pgajdos@suse.com
|
||
|
||
- provides suse_maintenance_mmn symbol [bnc#915666] (internal)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 10:05:17 UTC 2015 - pgajdos@suse.com
|
||
|
||
- credits to Roman Drahtmueller:
|
||
* add reference to /etc/permissions.local to output of %post if
|
||
setting the permissions of suexec2 fails
|
||
* do not enable mod_php5 by default any longer
|
||
* httpd-2.0.49-log_server_status.dif obsoleted
|
||
* apache2-mod_ssl_npn.patch removed because not used
|
||
* include mod_reqtimeout.conf in httpd.conf
|
||
* added cgid-timeout.conf, include
|
||
it in httpd.conf
|
||
- fix default value APACHE_MODULES in sysconfig file
|
||
- %service_* macros for apache2@.service
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 09:52:21 UTC 2015 - pgajdos@suse.com
|
||
|
||
- reenable 690734.patch, it should be upstreamed by the author
|
||
(Adrian Schroeter) though
|
||
+ httpd-2.4.9-bnc690734.patch
|
||
- httpd-2.2.x-bnc690734.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 13 09:51:34 UTC 2015 - pgajdos@suse.com
|
||
|
||
- drop startssl from start_apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 1 09:41:31 UTC 2015 - pgajdos@suse.com
|
||
|
||
- allow to run multiple instances of Apache on one system
|
||
[fate#317786] (internal)
|
||
* distributed httpd.conf no longer includes sysconfig.d, nor this
|
||
directory is shipped. httpd.conf includes loadmodule.conf and
|
||
global.conf which are former sysconfig.d/loadmodule.conf and
|
||
sysconfig.d/global.conf for default /etc/sysconfig/apache2
|
||
global.conf and loadmodule.conf are not included when
|
||
sysconfig variables could have been read by start_apache2
|
||
startup script (run with systemd services). Therefore, when
|
||
starting server via /usr/sbin/httpd, sysconfig variables
|
||
are not taken into account.
|
||
* some not-maintained scripts are moved from
|
||
/usr/share/apache2 to /usr/share/apache2/deprecated-scripts
|
||
* all modules comment in sysconfig file is not generated
|
||
anymore
|
||
* added README-instances.txt
|
||
* removed Sources:
|
||
load_configuration
|
||
find_mpm
|
||
get_module_list
|
||
get_includes
|
||
find_httpd_includes
|
||
apache-find-directives
|
||
* added Sources:
|
||
deprecated-scripts.tar.xz
|
||
apache2-README-instances.txt
|
||
apache2-loadmodule.conf
|
||
apache2-global.conf
|
||
apache2-find-directives
|
||
apache2@.service
|
||
apache2-script-helpers
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jun 25 15:52:14 UTC 2015 - kstreitova@suse.com
|
||
|
||
- add SSLHonorCipherOrder directive to apache2-ssl-global.conf
|
||
- adopt SSLCipherSuite directive value from SLE12
|
||
- remove default-vhost-ssl.conf and default-vhost.conf from
|
||
/etc/apache2. These two files are not (!) read by the
|
||
configuration framework, but are named *.conf, which is
|
||
misleading. The files are almost identical with the vhost
|
||
templates in /etc/apache2/vhosts.d/. The two templates there do
|
||
it right because they are not named *.conf and are not sourced
|
||
either. apache's response with no explicit (eg. default, vanilla)
|
||
configuration is contained in /etc/apache2/default-server.conf.
|
||
* remove apache2-README.default-vhost as there are no
|
||
default-vhost* files anymore.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jun 25 03:52:01 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- apache2.service: We have to use KillMode=mixed for the
|
||
graceful stop, restart to work properly.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jun 11 09:09:05 UTC 2015 - pgajdos@suse.com
|
||
|
||
- dropped 2.0 -> 2.2 modules transition during upgrade
|
||
* apache-20-22-upgrade renamed to apache-22-24-upgrade
|
||
- apache-*-upgrade script is called in %posttrans now [bnc#927223]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 9 09:04:32 UTC 2015 - pgajdos@suse.com
|
||
|
||
- fix find_mpm to echo mpm binary
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 2 23:17:40 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- apache2.service: Only order us after network.target and
|
||
nss-lookup.target but not pull the units in.
|
||
- apache2.service: SSL requires correct system time to
|
||
work properly, order after time-sync.target
|
||
|
||
-------------------------------------------------------------------
|
||
Tue May 26 11:57:44 UTC 2015 - pgajdos@suse.com
|
||
|
||
- align filenames with upstream names (and add compat symlinks)
|
||
- find_httpd2_includes renamed to find_httpd_includes
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 25 10:27:13 UTC 2015 - pgajdos@suse.com
|
||
|
||
- access_compat now built as shared and disabled by default
|
||
- amend config to use also old syntax when access_compat is
|
||
loaded
|
||
- added apache2-README-access_compat.txt
|
||
- added apache-find-directive script
|
||
- see [bnc#896083] and its duplicates
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 11 13:34:40 UTC 2015 - hguo@suse.com
|
||
|
||
- add httpd-2.4.12-CVE-2015-0253.patch to fix SECURITY: CVE-2015-0253
|
||
(cve.mitre.org) core: Fix a crash introduced in with ErrorDocument
|
||
400 pointing to a local URL-path with the INCLUDES filter active,
|
||
introduced in 2.4.11. PR 57531. [Yann Ylavic]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue May 5 12:36:10 UTC 2015 - kstreitova@suse.com
|
||
|
||
- simplify apache2.logrotate, use sharedscripts [bnc#713581]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue May 5 12:17:21 UTC 2015 - kstreitova@suse.com
|
||
|
||
- remove curly brackets around format sequence "%y" in
|
||
`stat --format="%{y}" %{SOURCE1}` that caused an incorrect
|
||
evaluation. Add escaping to proper spec-cleaner processing in
|
||
the future
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Apr 9 15:53:27 UTC 2015 - kstreitova@suse.com
|
||
|
||
- remove 'exit 0' from the %post section in the specfile that was
|
||
placed here incorrectly and caused that the rest of the %post
|
||
section couldn't be executed.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Apr 9 13:12:46 UTC 2015 - pgajdos@suse.com
|
||
|
||
- /etc/init.d/apache2 reload -> systemctl reload apache2.service
|
||
in apache2.logrotate [bnc#926523]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 30 08:42:07 UTC 2015 - pgajdos@suse.com
|
||
|
||
- authz_default -> authz_core in sysconfig.apache2/APACHE_MODULES
|
||
[bnc#922236]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 10 17:16:21 UTC 2015 - dimstar@opensuse.org
|
||
|
||
- Add Requires(post) apache2 to the subpackage -worker, -event and
|
||
-prefork: their respective post scriptlets execute
|
||
/usr/share/apache2/get_module_list, which is shipped as part of
|
||
the main package. This script has the side-effect to call
|
||
find_mpm, which in turn creates the corresponding /usr/sbin/httpd2
|
||
symlink.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 26 08:17:42 UTC 2015 - jsegitz@novell.com
|
||
|
||
- Patched get_module_list to ensure proper SELinux context for
|
||
sysconfig.d/loadmodule.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 21:02:59 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Pname -> name variable reduction
|
||
- Try to fix sle11 build
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 19:59:36 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Version bumpt o 2.4.12:
|
||
*) mpm_winnt: Accept utf-8 (Unicode) service names and descriptions for
|
||
internationalization. [William Rowe]
|
||
*) mpm_winnt: Normalize the error and status messages emitted by service.c,
|
||
the service control interface for Windows. [William Rowe]
|
||
*) configure: Fix --enable-v4-mapped configuration on *BSD. PR 53824.
|
||
[ olli hauer <ohauer gmx.de>, Yann Ylavic ]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 18:03:20 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Exit cleanly on end of the post and cleanup the update detection
|
||
- Remove Apache.xpm as it ain't used
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 15:59:26 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Cleanup init/unit decision making and provide just systemd service
|
||
on systemd systems
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 13:53:16 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Deprecate realver define as it is equal to version.
|
||
- Explicitely state MPM mods to ensure we don't lose some bnc#444878
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 25 13:23:40 UTC 2015 - tchvatal@suse.com
|
||
|
||
- Pass over spec-cleaner, there should be no actual technical
|
||
change in this just reduction of lines in the spec
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 23 16:58:11 UTC 2015 - kstreitova@suse.com
|
||
|
||
- add httpd-2.4.x-mod_lua_websocket_DoS.patch to fix mod_lua bug
|
||
where a maliciously crafted websockets PING after a script calls
|
||
r:wsupgrade() can cause a child process crash
|
||
[CVE-2015-0228], [bnc#918352].
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 3 15:12:04 UTC 2015 - pgajdos@suse.com
|
||
|
||
- httpd2.pid in rc.apache2 was wrong [bnc#898193]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 19 19:18:28 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- httpd-2.4.3-mod_systemd.patch find libsystemd-daemon
|
||
with pkg-config, this is the only correct way, in current
|
||
versions sd_notify is in libsystemd and in old products
|
||
in libsystemd-daemon.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 16 04:24:04 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- remove obsolete patches
|
||
* httpd-2.4.10-check_null_pointer_dereference.patch
|
||
* httpd-event-deadlock.patch
|
||
* httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
|
||
* httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 16 04:13:59 UTC 2015 - crrodriguez@opensuse.org
|
||
|
||
- Apache 2.4.11
|
||
|
||
*) SECURITY: CVE-2014-3583 (cve.mitre.org)
|
||
mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with
|
||
response headers' size above 8K. [Yann Ylavic, Jeff Trawick]
|
||
|
||
*) SECURITY: CVE-2014-3581 (cve.mitre.org)
|
||
mod_cache: Avoid a crash when Content-Type has an empty value.
|
||
PR 56924. [Mark Montague <mark catseye.org>, Jan Kaluza]
|
||
|
||
*) SECURITY: CVE-2014-8109 (cve.mitre.org)
|
||
mod_lua: Fix handling of the Require line when a LuaAuthzProvider is
|
||
used in multiple Require directives with different arguments.
|
||
PR57204 [Edward Lu <Chaosed0 gmail.com>]
|
||
|
||
*) SECURITY: CVE-2013-5704 (cve.mitre.org)
|
||
core: HTTP trailers could be used to replace HTTP headers
|
||
late during request processing, potentially undoing or
|
||
otherwise confusing modules that examined or modified
|
||
request headers earlier. Adds "MergeTrailers" directive to restore
|
||
legacy behavior. [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener]
|
||
|
||
*) mod_ssl: New directive SSLSessionTickets (On|Off).
|
||
The directive controls the use of TLS session tickets (RFC 5077),
|
||
default value is "On" (unchanged behavior).
|
||
Session ticket creation uses a random key created during web
|
||
server startup and recreated during restarts. No other key
|
||
recreation mechanism is available currently. Therefore using session
|
||
tickets without restarting the web server with an appropriate frequency
|
||
(e.g. daily) compromises perfect forward secrecy. [Rainer Jung]
|
||
|
||
*) mod_proxy_fcgi: Provide some basic alternate options for specifying
|
||
how PATH_INFO is passed to FastCGI backends by adding significance to
|
||
the value of proxy-fcgi-pathinfo. PR 55329. [Eric Covener]
|
||
|
||
*) mod_proxy_fcgi: Enable UDS backends configured with SetHandler/RewriteRule
|
||
to opt-in to connection reuse and other Proxy options via explicitly
|
||
declared "proxy workers" (<Proxy unix:... enablereuse=on max=...)
|
||
[Eric Covener]
|
||
|
||
*) mod_proxy: Add "enablereuse" option as the inverse of "disablereuse".
|
||
[Eric Covener]
|
||
|
||
*) mod_proxy_fcgi: Enable opt-in to TCP connection reuse by explicitly
|
||
setting proxy option disablereuse=off. [Eric Covener] PR 57378.
|
||
|
||
*) event: Update the internal "connection id" when requests
|
||
move from thread to thread. Reuse can confuse modules like
|
||
mod_cgid. PR 57435. [Michael Thorpe <mike gistnet.com>]
|
||
|
||
*) mod_proxy_fcgi: Remove proxy:balancer:// prefix from SCRIPT_FILENAME
|
||
passed to fastcgi backends. [Eric Covener]
|
||
|
||
*) core: Configuration files with long lines and continuation characters
|
||
are not read properly. PR 55910. [Manuel Mausz <manuel-as mausz.at>]
|
||
|
||
*) mod_include: the 'env' function was incorrectly handled as 'getenv' if the
|
||
leading 'e' was written in upper case in <!--#if expr="..." -->
|
||
statements. [Christophe Jaillet]
|
||
|
||
*) split-logfile: Fix perl error: 'Can't use string ("example.org:80")
|
||
as a symbol ref while "strict refs"'. PR 56329.
|
||
[Holger Mauermann <mauermann gmail.com>]
|
||
|
||
*) mod_proxy: Prevent ProxyPassReverse from doing a substitution when
|
||
the URL parameter interpolates to an empty string. PR 56603.
|
||
[<ajprout hotmail.com>]
|
||
|
||
*) core: Fix -D[efined] or <Define>[d] variables lifetime accross restarts.
|
||
PR 57328. [Armin Abfalterer <a.abfalterer gmail.com>, Yann Ylavic].
|
||
|
||
*) mod_proxy: Preserve original request headers even if they differ
|
||
from the ones to be forwarded to the backend. PR 45387.
|
||
[Yann Ylavic]
|
||
|
||
*) mod_ssl: dump SSL IO/state for the write side of the connection(s),
|
||
like reads (level TRACE4). [Yann Ylavic]
|
||
|
||
*) mod_proxy_fcgi: Ignore body data from backend for 304 responses. PR 57198.
|
||
[Jan Kaluza]
|
||
|
||
*) mod_ssl: Do not crash when looking up SSL related variables during
|
||
expression evaluation on non SSL connections. PR 57070 [Ruediger Pluem]
|
||
|
||
*) mod_proxy_ajp: Fix handling of the default port (8009) in the
|
||
ProxyPass and <Proxy> configurations. PR 57259. [Yann Ylavic]
|
||
|
||
*) mpm_event: Avoid a possible use after free when notifying the end of
|
||
connection during lingering close. PR 57268. [Eric Covener, Yann Ylavic]
|
||
|
||
*) mod_ssl: Fix recognition of OCSP stapling responses that are encoded
|
||
improperly or too large. [Jeff Trawick]
|
||
|
||
*) core: Add ap_log_data(), ap_log_rdata(), etc. for logging buffers.
|
||
[Jeff Trawick]
|
||
|
||
*) mod_proxy_fcgi, mod_authnz_fcgi: stop reading the response and issue an
|
||
error when parsing or forwarding the response fails. [Yann Ylavic]
|
||
|
||
*) mod_ssl: Fix a memory leak in case of graceful restarts with OpenSSL >= 0.9.8e
|
||
PR 53435 [tadanori <tadanori2007 yahoo.com>, Sebastian Wiedenroth <wiedi frubar.net>]
|
||
|
||
*) mod_proxy_connect: Don't issue AH02447 on sockets hangups, let the read
|
||
determine whether it is a normal close or a real error. PR 57168. [Yann
|
||
Ylavic]
|
||
|
||
*) mod_proxy_wstunnel: abort backend connection on polling error to avoid
|
||
further processing. [Yann Ylavic]
|
||
|
||
*) core: Support custom ErrorDocuments for HTTP 501 and 414 status codes.
|
||
PR 57167 [Edward Lu <Chaosed0 gmail.com>]
|
||
|
||
*) mod_proxy_connect: Fix ProxyRemote to https:// backends on EBCDIC
|
||
systems. PR 57092 [Edward Lu <Chaosed0 gmail.com>]
|
||
|
||
*) mod_cache: Avoid a 304 response to an unconditional requst when an AH00752
|
||
CacheLock error occurs during cache revalidation. [Eric Covener]
|
||
|
||
*) mod_ssl: Move OCSP stapling information from a per-certificate store to
|
||
a per-server hash. PR 54357, PR 56919. [Alex Bligh <alex alex.org.uk>,
|
||
Yann Ylavic, Kaspar Brand]
|
||
|
||
*) mod_cache_socache: Change average object size hint from 32 bytes to
|
||
2048 bytes. [Rainer Jung]
|
||
|
||
*) mod_cache_socache: Add cache status to server-status. [Rainer Jung]
|
||
|
||
*) event: Fix worker-listener deadlock in graceful restart.
|
||
PR 56960.
|
||
|
||
*) Concat strings at compile time when possible. PR 53741.
|
||
|
||
*) mod_substitute: Restrict configuration in .htaccess to
|
||
FileInfo as documented. [Rainer Jung]
|
||
|
||
*) mod_substitute: Make maximum line length configurable. [Rainer Jung]
|
||
|
||
*) mod_substitute: Fix line length limitation in case of regexp plus flatten.
|
||
[Rainer Jung]
|
||
|
||
*) mod_proxy: Truncated character worker names are no longer fatal
|
||
errors. PR53218. [Jim Jagielski]
|
||
|
||
*) mod_dav: Set r->status_line in dav_error_response. PR 55426.
|
||
|
||
*) mod_proxy_http, mod_cache: Avoid (unlikely) accesses to freed memory.
|
||
[Yann Ylavic, Christophe Jaillet]
|
||
|
||
*) http_protocol: fix logic in ap_method_list_(add|remove) in order:
|
||
- to correctly reset bits
|
||
- not to modify the 'method_mask' bitfield unnecessarily
|
||
[Christophe Jaillet]
|
||
|
||
*) mod_slotmem_shm: Increase log level for some originally debug messages.
|
||
[Jim Jagielski]
|
||
|
||
*) mod_ldap: In 2.4.10, some LDAP searches or comparisons might be done with
|
||
the wrong credentials when a backend connection is reused.
|
||
[Eric Covener]
|
||
|
||
*) mod_macro: Add missing APLOGNO for some Warning log messages.
|
||
[Christophe Jaillet]
|
||
|
||
*) mod_cache: Avoid sending 304 responses during failed revalidations
|
||
PR56881. [Eric Covener]
|
||
|
||
*) mod_status: Honor client IP address using mod_remoteip. PR 55886.
|
||
[Jim Jagielski]
|
||
|
||
*) cmake-based build for Windows: Fix incompatibility with cmake 2.8.12
|
||
and later. PR 56615. [Chuck Liu <cliu81 gmail.com>, Jeff Trawick]
|
||
|
||
*) mod_ratelimit: Drop severity of AH01455 and AH01457 (ap_pass_brigade
|
||
failed) messages from ERROR to TRACE1. Other filters do not bother
|
||
re-reporting failures from lower level filters. PR56832. [Eric Covener]
|
||
|
||
*) core: Avoid useless warning message when parsing a section guarded by
|
||
<IfDefine foo> if $(foo) is used within the section.
|
||
PR 56503 [Christophe Jaillet]
|
||
|
||
*) mod_proxy_fcgi: Fix faulty logging of large amounts of stderr from the
|
||
application. PR 56858. [Manuel Mausz <manuel-asf mausz.at>]
|
||
|
||
*) mod_proxy_http: Proxy responses with error status and
|
||
"ProxyErrorOverride On" hang until proxy timeout.
|
||
PR53420 [Rainer Jung]
|
||
|
||
*) mod_log_config: Allow three character log formats to be registered. For
|
||
backwards compatibility, the first character of a three-character format
|
||
must be the '^' (caret) character. [Eric Covener]
|
||
|
||
*) mod_lua: Don't quote Expires and Path values. PR 56734.
|
||
[Keith Mashinter, <kmashint yahoo com>]
|
||
|
||
*) mod_authz_core: Allow <AuthzProviderAlias>'es to be seen from auth
|
||
stanzas under virtual hosts. PR 56870. [Eric Covener]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 12 10:51:32 UTC 2015 - bruno@ioda-net.ch
|
||
|
||
- Redone lost patch to fix boo#859439
|
||
+ service reload can cause log data to be lost with logrotate
|
||
under some circumstances: remove "-t" from service reload.
|
||
[bnc#859439]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jan 8 13:03:24 UTC 2015 - schwab@linux-m68k.org
|
||
|
||
- Fix URL syntax in various files
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 29 15:12:51 UTC 2014 - pgajdos@suse.com
|
||
|
||
- fix IfModule directive around SSLSessionCache [bnc#842377c#11]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 15 17:29:28 UTC 2014 - kstreitova@suse.com
|
||
|
||
- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
|
||
to fix flaw in the way mod_headers handled chunked requests. Adds
|
||
"MergeTrailers" directive to restore legacy behavior
|
||
[bnc#871310], [CVE-2013-5704].
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 12 15:46:29 UTC 2014 - kstreitova@suse.com
|
||
|
||
- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
|
||
that fixes handling of the Require line when a LuaAuthzProvider is
|
||
used in multiple Require directives with different arguments
|
||
[bnc#909715], [CVE-2014-8109].
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 5 20:10:28 UTC 2014 - pgajdos@suse.com
|
||
|
||
- fixed start at boot for ssl and encrypted key [bnc#792309]
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Nov 29 02:43:00 UTC 2014 - Led <ledest@gmail.com>
|
||
|
||
- fix shebang in start_apache2 script that contains bash-specific
|
||
constructions
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 27 13:38:25 UTC 2014 - pgajdos@suse.com
|
||
|
||
- small improvement of ssl instructions [bnc#891813]
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Nov 09 00:57:00 UTC 2014 - Led <ledest@gmail.com>
|
||
|
||
- fix bashisms in post scripts
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 7 15:52:47 UTC 2014 - kstreitova@suse.com
|
||
|
||
- added httpd-2.4.10-check_null_pointer_dereference.patch to avoid
|
||
a crash when Content-Type has an empty value [bnc#899836],
|
||
CVE-2014-3581
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 31 16:04:15 UTC 2014 - crrodriguez@opensuse.org
|
||
|
||
- httpd-event-deadlock.patch: Fix worker-listener
|
||
deadlock in graceful restart.
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Oct 18 16:21:00 UTC 2014 - Led <ledest@gmail.com>
|
||
|
||
- httpd-2.1.9-apachectl.dif renamed to httpd-2.4.10-apachectl.patch
|
||
and updated (fixed bashism).
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 16 12:29:06 UTC 2014 - pgajdos@suse.com
|
||
|
||
- drop (turned off) itk mpm spec file code as mpm-itk is now
|
||
provided as a separate module, not via patch
|
||
(see http://mpm-itk.sesse.net/ and [bnc#851229])
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 13 12:34:44 UTC 2014 - pgajdos@suse.com
|
||
|
||
- enable mod_imagemap [bnc#866366]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 10 07:48:45 UTC 2014 - pgajdos@suse.com
|
||
|
||
- fixed link to Apache quickstart [bnc#624681], [bnc#789806]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 6 12:30:07 UTC 2014 - kstreitova@suse.com
|
||
|
||
- the following unused patches were removed from the package:
|
||
* apache2-mod_ssl_npn.patch
|
||
* httpd-2.0.49-log_server_status.dif
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 29 11:57:40 UTC 2014 - pgajdos@suse.com
|
||
|
||
- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
|
||
/usr/sbin/start_apache2 [bnc#851627]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 26 15:38:17 UTC 2014 - oholecek@suse.com
|
||
|
||
- allow only TCP ports in Yast2 firewall files
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 26 15:00:45 UTC 2014 - pgajdos@suse.com
|
||
|
||
- more 2.2 -> 2.4 [bnc#862058]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 25 14:39:05 UTC 2014 - pgajdos@suse.com
|
||
|
||
- ServerSignature=Off and ServerTokens=Prod by request from
|
||
security team [bnc#716495]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 24 13:11:16 UTC 2014 - pgajdos@suse.com
|
||
|
||
- fix documentation links 2.2 -> 2.4 [bnc#888163] (internal)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 21 16:23:51 UTC 2014 - crrodriguez@opensuse.org
|
||
|
||
- Update package Summary and Description.
|
||
- version 2.4.10
|
||
* SECURITY: CVE-2014-0117 (cve.mitre.org)
|
||
* SECURITY: CVE-2014-3523 (cve.mitre.org)
|
||
* SECURITY: CVE-2014-0226 (cve.mitre.org)
|
||
* SECURITY: CVE-2014-0118 (cve.mitre.org)
|
||
* SECURITY: CVE-2014-0231 (cve.mitre.org)
|
||
* Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
|
||
* mod_proxy_fcgi supports unix sockets.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 21 07:21:21 UTC 2014 - mc@suse.com
|
||
|
||
- provide httpd.service as alias for apache2.service for
|
||
compatibility reasons (bnc#888093)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 14 08:47:02 UTC 2014 - lnussel@suse.de
|
||
|
||
- move most ssl options to ssl-global.conf. There is usually no need
|
||
for every vhost to re-define the ciphers for example (bnc#865582).
|
||
Drop some commented entries that only lead to confusion.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 27 16:18:27 UTC 2014 - crrodriguez@opensuse.org
|
||
|
||
- version 2.4.9
|
||
* SECURITY: CVE-2014-0098
|
||
* SECURITY: CVE-2013-6438
|
||
* multiple bugfixes and improvements to mod_ssl, mod_lua,
|
||
mod_session and core, see CHANGES for details.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 17 18:31:11 CET 2014 - draht@suse.de
|
||
|
||
- /etc/sysconfig/apache2: add socache_shmcb to the list of modules
|
||
that are enabled.
|
||
/etc/apache2/ssl-global.conf: make SSLSessionCache shmcb...
|
||
conditional on IfModule socache_shmcb.
|
||
The same applies to SSLSessionCache dmb:* via module socache_dbm
|
||
in commented section of same file. [bnc#864185]
|
||
- /etc/sysconfig/apache2: remove reference to non-existing script
|
||
/usr/share/doc/packages/apache2/certificate.sh, which was only a
|
||
wrapper to mkcert.sh anyways. [bnc#864185]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 25 22:15:51 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- update to apache 2.4.7, important changes:
|
||
|
||
* This release requires both apr and apr-util 1.5.x series
|
||
and therefore will no longer build in older released products
|
||
* mod_ssl: Improve handling of ephemeral DH and ECDH keys
|
||
(obsoletes httpd-mod_ssl_ephemeralkeyhandling.patch)
|
||
* event MPM: Fix possible crashes
|
||
* mod_deflate: Improve error detection
|
||
* core: Add open_htaccess hook in conjunction with dirwalk_stat.
|
||
* mod_rewrite: Make rewrite websocket-aware to allow proxying.
|
||
* mod_ssl: drop support for export-grade ciphers with ephemeral RSA
|
||
keys, and unconditionally disable aNULL, eNULL and EXP ciphers
|
||
(not overridable via SSLCipherSuite)
|
||
* core, mod_ssl: Enable the ability for a module to reverse the
|
||
sense of a poll event from a read to a write or vice versa
|
||
(obsoletes httpd-event-ssl.patch)
|
||
* see CHANGES for more details
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Nov 16 00:52:15 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- httpd-mod_ssl_ephemeralkeyhandling.patch obsoletes
|
||
mod_ssl-2.4.x-ekh.diff this new patch is the final
|
||
form of the rework, merged for 2.4.7.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 4 20:55:52 UTC 2013 - freek@opensuse.org
|
||
|
||
- Removed obsolete directive DefaultType
|
||
- Changed all access control to new Require directive
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 25 00:05:02 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- reenable mod_ssl-2.4.x-ekh.diff
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 22 15:43:53 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Correct build in old distros.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 22 15:09:21 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- disable (revert) mod_ssl changes in the previous
|
||
commit so it does not end in factory or 13.1 yet.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 22 15:06:19 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- make mod_systemd static so scenarios described in
|
||
[bnc#846897] do not happen again.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 21 23:44:19 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- mod_ssl: improve ephemeral key handling in particular, support DH params
|
||
with more than 1024 bits, and allow custom configuration.
|
||
This patch adjust DH parameters according to the relevant RFC
|
||
recommendations and permanently disables the usage of "export"
|
||
and "NULL" ciphers no matter what the user configuration is
|
||
(mod_ssl-2.4.x-ekh.diff, to be in 2.4.7)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 21 23:27:56 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- fix [bnc#846897] problems building kiwi images due to
|
||
systemd not being running in chroot. (submit to 13.1 ASAP)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 14 19:58:23 UTC 2013 - aj@suse.com
|
||
|
||
- Fix SUSE spelling.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 3 15:37:37 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Also fix subtle non-obvious systemd unit confusion
|
||
we really mean -DFOREGROUND not -DNO_DETACH the latter only
|
||
inhibits the parent from forking, not quite the same as
|
||
running in well.. the foreground as required.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 3 03:58:27 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Ensure we only use /run and not /var/run
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 30 04:48:07 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Really use %requires_ge for libapr1 and libapr-util1
|
||
mentioned but not implemented in the previous commit.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 28 07:29:47 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Use %requires_ge for libapr1 and libapr-util1
|
||
- apache2-default-server.conf: Need to use IncludeOptional
|
||
- apache-20-22-upgrade: also load authz_core
|
||
- httpd-visibility.patch: Use compiler symbol visibility.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 2 08:18:03 UTC 2013 - meissner@suse.com
|
||
|
||
- Make the default keysize in the sample gensslcerts 2048 bits to match
|
||
government recommendations.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 1 02:06:38 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Enable mod_proxy_html, mod_xml2enc and mod_lua (missed BuildRequires)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 29 19:53:48 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- provide and obsolete mod_macro
|
||
- upgrade: some people complain that log_config module
|
||
is not enabled by default sometimes, fix that.
|
||
- upgrade : "SSLMutex" no longer exists.
|
||
- Toogle EnableSendfile on because now apache defaults to off
|
||
due to kernel bugs. that's a silly thing to do here
|
||
as kernel bugs have to be fixed at their source, not worked around
|
||
in applications.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 22 21:57:40 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- httpd-event-ssl.patch: from upstream
|
||
Lift the restriction that prevents mod_ssl taking
|
||
full advantage of the event MPM.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 22 16:44:22 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Update to version 2.4.6
|
||
* SECURITY: CVE-2013-1896 (cve.mitre.org)
|
||
* SECURITY: CVE-2013-2249 (cve.mitre.org)
|
||
* Major updates to mod_lua
|
||
* Support for proxying websocket requests
|
||
* Higher performant shm-based cache implementation
|
||
* Addition of mod_macro for easier configuration management
|
||
* As well as several exciting fixes, especially those related to RFC edge
|
||
cases in mod_cache and mod_proxy.
|
||
|
||
- IMPORTANT : With the current packaging scheme, we can no longer
|
||
Include the ITK MPM, therefore it has been disabled. This is because
|
||
this MPM can now only be provided as a loadable module but we do
|
||
not currently build MPMs as shared modules but as independant
|
||
binaries and all helpers/startup scripts depend on that behaviour.
|
||
It will be fixed in the upcoming weeks/months.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 18 07:41:36 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- apache-20-22-upgrade: still no cookie, module authn_file
|
||
is ok and must not be disabled on update.
|
||
authn_core must however be enabled too.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 18 06:42:33 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- fix apache_mmn spec macro, otherwise all modules down
|
||
the chain will have broken dependencies
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 18 05:53:31 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- remove After=mysql.service php-fpm.service postgresql.service
|
||
which were added in the previous change, those must be added
|
||
as Before=apache2.service in the respective services.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 14 21:51:09 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Include mod_systemd for more complete integration with
|
||
systemd, turn the service to Typé=notify as required
|
||
|
||
- Disable SSL NPN patch for now, it is required for mod_spdy
|
||
but mod_spdy does not support apache 2.4
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jun 1 03:54:50 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- apache 2.4.4
|
||
* fix for CVE-2012-3499
|
||
* fix for the CRIME attack (disable ssl compression by default)
|
||
* many other bugfies
|
||
|
||
* build access_compat amd unixd as static modules and solve
|
||
some other upgrade quirks (bnc#813705)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 25 08:19:41 UTC 2013 - mlin@suse.com
|
||
|
||
- Install apache2.service accordingly (/usr/lib/systemd for 12.3
|
||
and up or /lib/systemd for older versions).
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jan 26 05:06:07 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Apache 2.4.3
|
||
* SECURITY: CVE-2012-3502
|
||
* SECURITY: CVE-2012-2687
|
||
* mod_cache: Set content type in case we return stale content.
|
||
* lots of bugfixes see http://www.apache.org/dist/httpd/CHANGES_2.4.3
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jan 26 05:00:00 UTC 2013 - crrodriguez@opensuse.org
|
||
|
||
- Improve systemd unit file (tested for months)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 18 11:52:30 CET 2013 - mhrusecky@suse.cz
|
||
|
||
- use %set_permissions instead %run_permissions (bnc#764097)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 1 04:10:13 UTC 2012 - crrodriguez@opensuse.org
|
||
|
||
- Fix factory-auto (aka r2dbag) complains about URL.
|
||
- Provide a symlink for apxs2 new location otherwise
|
||
all buggy spec files of external modules will break.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 1 02:21:34 UTC 2012 - crrodriguez@opensuse.org
|
||
|
||
- BuildRequire xz explicitly, fix build in !Factory
|
||
- Drop more old, unused patches
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 1 01:14:35 UTC 2012 - crrodriguez@opensuse.org
|
||
|
||
- Upgrade to apache 2.4.2
|
||
** ATTENTION, before installing this update YOU MUST
|
||
READ https://httpd.apache.org/docs/2.4/upgrading.html
|
||
CAREFULLY otherwise your server will most likely
|
||
fail to start due to backward incompatible changes.
|
||
|
||
* You can read the huge complete list of changes
|
||
at https://httpd.apache.org/docs/2.4/new_features_2_4.html
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 25 11:32:34 UTC 2012 - saschpe@suse.de
|
||
|
||
- gensslcert: Use 0400 permissions for generated SSL certificate files
|
||
instead of 0644
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jul 6 11:58:03 UTC 2012 - meissner@suse.com
|
||
|
||
- modified apache2.2-mpm-itk-20090414-00.patch to fix
|
||
itk running as root. bnc#681176 / CVE-2011-1176
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jul 6 09:42:00 UTC 2012 - meissner@suse.com
|
||
|
||
- remove the insecure LD_LIBRARY_PATH line. bnc#757710
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Apr 22 20:14:22 UTC 2012 - dimstar@opensuse.org
|
||
|
||
- Add apache2-mod_ssl_npn.patch: Add npn support to mod_ssl, which
|
||
is needed by spdy.
|
||
- Provide apache2(mod_ssl+npn), indicating that our mod_ssl does
|
||
have the npn patch. This can be used by mod_spdy to ensure a
|
||
compatible apache/mod_ssl is installed.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 20 14:05:49 UTC 2012 - adrian@suse.de
|
||
|
||
- fix truncating and resulting paniking of answer headers (bnc#690734)
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Feb 18 21:15:08 UTC 2012 - poeml@cmdline.net
|
||
|
||
- update to 2.2.22
|
||
*) SECURITY: CVE-2011-3368 (cve.mitre.org)
|
||
Reject requests where the request-URI does not match the HTTP
|
||
specification, preventing unexpected expansion of target URLs in
|
||
some reverse proxy configurations.
|
||
*) SECURITY: CVE-2011-3607 (cve.mitre.org)
|
||
Fix integer overflow in ap_pregsub() which, when the mod_setenvif module
|
||
is enabled, could allow local users to gain privileges via a .htaccess
|
||
file.
|
||
*) SECURITY: CVE-2011-4317 (cve.mitre.org)
|
||
Resolve additional cases of URL rewriting with ProxyPassMatch or
|
||
RewriteRule, where particular request-URIs could result in undesired
|
||
backend network exposure in some configurations.
|
||
*) SECURITY: CVE-2012-0021 (cve.mitre.org)
|
||
mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format
|
||
string is in use and a client sends a nameless, valueless cookie, causing
|
||
a denial of service. The issue existed since version 2.2.17. PR 52256.
|
||
*) SECURITY: CVE-2012-0031 (cve.mitre.org)
|
||
Fix scoreboard issue which could allow an unprivileged child process
|
||
could cause the parent to crash at shutdown rather than terminate
|
||
cleanly.
|
||
*) SECURITY: CVE-2012-0053 (cve.mitre.org)
|
||
Fix an issue in error responses that could expose "httpOnly" cookies
|
||
when no custom ErrorDocument is specified for status code 400.
|
||
*) mod_proxy_ajp: Try to prevent a single long request from marking a worker
|
||
in error.
|
||
*) config: Update the default mod_ssl configuration: Disable SSLv2, only
|
||
allow >= 128bit ciphers, add commented example for speed optimized cipher
|
||
list, limit MSIE workaround to MSIE <= 5.
|
||
*) core: Fix segfault in ap_send_interim_response(). PR 52315.
|
||
*) mod_log_config: Prevent segfault. PR 50861.
|
||
*) mod_win32: Invert logic for env var UTF-8 fixing.
|
||
Now we exclude a list of vars which we know for sure they dont hold UTF-8
|
||
chars; all other vars will be fixed. This has the benefit that now also
|
||
all vars from 3rd-party modules will be fixed. PR 13029 / 34985.
|
||
*) core: Fix hook sorting for Perl modules, a regression introduced in
|
||
2.2.21. PR: 45076.
|
||
*) Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20:
|
||
A range of '0-' will now return 206 instead of 200. PR 51878.
|
||
*) Example configuration: Fix entry for MaxRanges (use "unlimited" instead
|
||
of "0").
|
||
*) mod_substitute: Fix buffer overrun.
|
||
- adjusted SSL template/default config for upstream changes, and added
|
||
MaxRanges example to apache2-server-tuning.conf
|
||
- fixed installation of (moved) man pages
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Feb 11 09:21:15 UTC 2012 - coolo@suse.com
|
||
|
||
- compile with pcre 8.30 - patch taken from apache bugzilla
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jan 21 13:54:01 CET 2012 - draht@suse.de
|
||
|
||
- enable mod_reqtimeout by default via APACHE_MODULES in
|
||
/etc/sysconfig/apache2, configuration
|
||
/etc/apache2/mod_reqtimeout.conf .
|
||
Of course, the existing configuration remains unchanged.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 16 20:53:39 UTC 2011 - chris@computersalat.de
|
||
|
||
- add default vhost configs
|
||
* default-vhost.conf, default-vhost-ssl.conf, README.default-vhost
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 10 10:34:26 CET 2011 - meissner@suse.de
|
||
|
||
- openldap2 is not necessary, just openldap2-devel as buildrequires
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Dec 2 07:18:56 UTC 2011 - coolo@suse.com
|
||
|
||
- add automake as buildrequire to avoid implicit dependency
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 18 15:04:12 CET 2011 - draht@suse.de
|
||
|
||
- update to /etc/init.d/apache2: handle reload with deleted
|
||
binaries after package update more thoughtfully: If the binaries
|
||
have been replaced, then a dlopen(3) on the apache modules is
|
||
prone to fail. => Don't reload then, but complain and fail.
|
||
Especially important for logrotate!
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 7 17:11:56 CEST 2011 - draht@suse.de
|
||
|
||
- httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff fixes mod_proxy
|
||
reverse exposure via RewriteRule or ProxyPassMatch directives.
|
||
This is CVE-2011-3368.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 7 14:36:31 UTC 2011 - fcrozat@suse.com
|
||
|
||
- Ensure service_add_pre macro is correctly called for
|
||
openSUSE 12.1 or later.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 27 08:19:35 UTC 2011 - fcrozat@suse.com
|
||
|
||
- Fix systemd files packaging, %ghost is not a good idea.
|
||
- Use systemd rpm macros for openSUSE 12.1 and later.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 15 13:33:30 CEST 2011 - draht@suse.de
|
||
|
||
- don't create $RPM_BUILD_ROOT/etc/init.d twice in %install.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 14 01:11:55 CEST 2011 - draht@suse.de
|
||
|
||
- Update to 2.2.21. News therein:
|
||
* re-worked CVE-2011-3192 (byterange_filter.c) with a regression
|
||
fix. New config option: MaxRanges (PR 51748)
|
||
* multi fixes in mod_filter, mod_proxy_ajp, mod_dav_fs,
|
||
mod_alias, mod_rewrite. As always, see CHANGES file.
|
||
- added httpd-%{realver}.tar.bz2.asc to source, along with
|
||
60C5442D.key which the tarball was signed with.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 13 10:37:37 CEST 2011 - draht@suse.de
|
||
|
||
- need to add %ghost /lib/systemd to satisfy distributions that
|
||
have no systemd yet.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 1 09:43:49 UTC 2011 - fcrozat@suse.com
|
||
|
||
- Add apache2-systemd-ask-pass / apache2.service / start_apache2
|
||
and modify apache2-ssl-global.conf for systemd support
|
||
(bnc#697137).
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 31 12:52:22 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Update to version 2.2.20, fix CVE-2011-3192
|
||
mod_deflate D.o.S.
|
||
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 5 06:02:35 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Fix apache PR 45076
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jul 17 19:49:55 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Use SSL_MODE_RELEASE_BUFFERS to reduce mod_ssl memory usage
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 22 16:12:10 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Add 2 patches from the "low hanging fruit" warnings in apache
|
||
STATUS page.
|
||
* mod_deflate: Stop compressing HEAD requests
|
||
if there is not Content-Length header
|
||
* mod_reqtimeout: Disable keep-alive after read timeout
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 10 00:59:53 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Remove -fno-strict-aliasing from CFLAGS, no longer needed.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 8 19:10:41 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Allow KeepAliveTimeout to be expressed in miliseconds
|
||
sometimes one second is too long, upstream r733557.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jun 6 18:16:05 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- When linux changes to version 3.x configure tests are gonna break.
|
||
remove version check, assuming kernel 2.2 or later.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu May 26 03:35:05 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Update to 2.2.19, only one bugfix.
|
||
*) Revert ABI breakage in 2.2.18 caused by the function signature change
|
||
of ap_unescape_url_keep2f(). This release restores the signature from
|
||
2.2.17 and prior, and introduces ap_unescape_url_keep2f_ex().
|
||
[Eric Covener]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri May 20 19:28:03 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Remove SSLv2 disabled patch, already in upstream.
|
||
- Update to version 2.2.18
|
||
* mod_ssl, ab: Support OpenSSL compiled without SSLv2 support.
|
||
* core: Treat timeout reading request as 408 error, not 400.
|
||
* core: Only log a 408 if it is no keepalive timeout.
|
||
* mod_rewrite: Allow to unset environment variables.
|
||
* prefork: Update MPM state in children during a graceful restart.
|
||
* Other fixes in mod_cache,mod_dav,mod_proxy se NEWS for detail.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Apr 20 23:24:26 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Fix regular expression in vhost ssl template IE workaround
|
||
it is obsolete see https://issues.apache.org/bugzilla/show_bug.cgi?id=49484
|
||
You should apply this update to fix painfully slow SSL
|
||
connections when using IE.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 11 16:19:14 UTC 2011 - crrodriguez@opensuse.org
|
||
|
||
- Allow usage of an openSSL library compiled without SSlv2
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 8 13:41:48 UTC 2011 - lnussel@suse.de
|
||
|
||
- set sane default cipher string in apache2-vhost-ssl.template
|
||
- remove useless example snakeoil certs
|
||
- remove broken mkcert script
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 17 12:39:06 CET 2011 - werner@suse.de
|
||
|
||
- Tag boot script as interactive as systemd uses it
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 7 16:25:16 UTC 2011 - lnussel@suse.de
|
||
|
||
- recommend the default mpm package (bnc#670027)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 19 17:16:16 UTC 2010 - poeml@cmdline.net
|
||
|
||
- update to 2.2.17:
|
||
SECURITY: CVE-2010-1623 (cve.mitre.org)
|
||
Fix a denial of service attack against apr_brigade_split_line().
|
||
[Actual fix is in the libapr 1.3 line, which we don't use // poeml]
|
||
SECURITY: CVE-2009-3560, CVE-2009-3720 (cve.mitre.org)
|
||
Fix two buffer over-read flaws in the bundled copy of expat which could
|
||
cause applications to crash while parsing specially-crafted XML documents.
|
||
[We build with system expat library // poeml]
|
||
prefork MPM: Run cleanups for final request when process exits gracefully
|
||
to work around a flaw in apr-util. PR 43857
|
||
core:
|
||
- check symlink ownership if both FollowSymlinks and
|
||
SymlinksIfOwnerMatch are set
|
||
- fix origin checking in SymlinksIfOwnerMatch PR 36783
|
||
- (re)-introduce -T commandline option to suppress documentroot
|
||
check at startup. PR 41887
|
||
vhost:
|
||
- A purely-numeric Host: header should not be treated as a port. PR 44979
|
||
rotatelogs:
|
||
- Fix possible buffer overflow if admin configures a
|
||
mongo log file path.
|
||
Proxy balancer: support setting error status according to HTTP response
|
||
code from a backend. PR 48939.
|
||
mod_authnz_ldap:
|
||
- If AuthLDAPCharsetConfig is set, also convert the
|
||
password to UTF-8. PR 45318.
|
||
mod_dir, mod_negotiation:
|
||
- Pass the output filter information to newly created sub requests; as these
|
||
are later on used as true requests with an internal redirect. This allows
|
||
for mod_cache et.al. to trap the results of the redirect. PR 17629, 43939
|
||
mod_headers:
|
||
- Enable multi-match-and-replace edit option PR 46594
|
||
mod_log_config:
|
||
- Make ${cookie}C correctly match whole cookie names
|
||
instead of substrings. PR 28037.
|
||
mod_reqtimeout:
|
||
- Do not wrongly enforce timeouts for mod_proxy's backend
|
||
connections and other protocol handlers (like mod_ftp). Enforce the
|
||
timeout for AP_MODE_GETLINE. If there is a timeout, shorten the lingering
|
||
close time from 30 to 2 seconds.
|
||
mod_ssl:
|
||
- Do not do overlapping memcpy. PR 45444
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 5 18:25:39 UTC 2010 - cristian.rodriguez@opensuse.org
|
||
|
||
- Add missing libcap-devel to BuildRequires, wanted by "itk" MPM.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jul 29 15:40:29 UTC 2010 - poeml@cmdline.net
|
||
|
||
- update to 2.2.16:
|
||
SECURITY: CVE-2010-1452 (cve.mitre.org)
|
||
mod_dav, mod_cache: Fix Handling of requests without a path segment.
|
||
PR: 49246
|
||
SECURITY: CVE-2010-2068 (cve.mitre.org)
|
||
mod_proxy_ajp, mod_proxy_http, mod_reqtimeout: Fix timeout detection
|
||
for platforms Windows, Netware and OS2. PR: 49417.
|
||
core:
|
||
- Filter init functions are now run strictly once per request
|
||
before handler invocation. The init functions are no longer run
|
||
for connection filters. PR 49328.
|
||
mod_filter:
|
||
- enable it to act on non-200 responses. PR 48377
|
||
mod_ldap:
|
||
- LDAP caching was suppressed (and ldap-status handler returns
|
||
title page only) when any mod_ldap directives were used in VirtualHost
|
||
context.
|
||
mod_ssl:
|
||
- Fix segfault at startup if proxy client certs are shared
|
||
across multiple vhosts. PR 39915.
|
||
mod_proxy_http:
|
||
- Log the port of the remote server in various messages.
|
||
PR 48812.
|
||
apxs:
|
||
- Fix -A and -a options to ignore whitespace in httpd.conf
|
||
mod_dir:
|
||
- add FallbackResource directive, to enable admin to specify
|
||
an action to happen when a URL maps to no file, without resorting
|
||
to ErrorDocument or mod_rewrite. PR 47184
|
||
mod_rewrite:
|
||
- Allow to set environment variables without explicitely
|
||
giving a value.
|
||
- add Requires and BuildRequires on libapr1 >= 1.4.2. In the past, libapr1 >=
|
||
1.0 was sufficient. But since 2.2.16, a failure to create listen sockets can
|
||
occur, unless newer libapr1 is used. See
|
||
https://bugzilla.redhat.com/show_bug.cgi?id=516331
|
||
- remove obsolete httpd-2.2.15-deprecated_use_of_build_in_variable.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 17 14:33:47 UTC 2010 - poeml@cmdline.net
|
||
|
||
- add type and encoding for zipped SVG images (.svgz)
|
||
Thanks to Sebastian Siebert (via Submit Request #40059)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue May 11 21:42:11 UTC 2010 - lars@linux-schulserver.de
|
||
|
||
- fix deprecated usage of $[ in apxs2
|
||
(httpd-2.2.15-deprecated_use_of_build_in_variable.patch)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri May 7 12:38:10 UTC 2010 - aj@suse.de
|
||
|
||
- Do not compile in build time but use mtime of changes file instead.
|
||
This allows build-compare to identify that no changes have happened.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 30 23:49:28 UTC 2010 - poeml@cmdline.net
|
||
|
||
- add apache2-prefork to the Requires of apache2-devel, because apxs2 will
|
||
build for prefork, if not called as apxs2-worker (which should rarely be the
|
||
case). Also added gcc to the Requires.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 8 12:34:18 UTC 2010 - poeml@cmdline.net
|
||
|
||
- update to 2.2.15:
|
||
SECURITY: CVE-2009-3555 (cve.mitre.org)
|
||
mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection
|
||
attack when compiled against OpenSSL version 0.9.8m or later. Introduces
|
||
the 'SSLInsecureRenegotiation' directive to reopen this vulnerability and
|
||
offer unsafe legacy renegotiation with clients which do not yet support
|
||
the new secure renegotiation protocol, RFC 5746.
|
||
SECURITY: CVE-2009-3555 (cve.mitre.org)
|
||
mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
|
||
by rejecting any client-initiated renegotiations. Forcibly disable
|
||
keepalive for the connection if there is any buffered data readable. Any
|
||
configuration which requires renegotiation for per-directory/location
|
||
access control is still vulnerable, unless using OpenSSL >= 0.9.8l.
|
||
SECURITY: CVE-2010-0408 (cve.mitre.org)
|
||
mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent
|
||
when request headers indicate a request body is incoming; not a case of
|
||
HTTP_INTERNAL_SERVER_ERROR.
|
||
SECURITY: CVE-2010-0425 (cve.mitre.org)
|
||
mod_isapi: Do not unload an isapi .dll module until the request processing
|
||
is completed, avoiding orphaned callback pointers.
|
||
SECURITY: CVE-2010-0434 (cve.mitre.org)
|
||
Ensure each subrequest has a shallow copy of headers_in so that the parent
|
||
request headers are not corrupted. Elimiates a problematic optimization
|
||
in the case of no request body. PR 48359
|
||
mod_reqtimeout:
|
||
- New module to set timeouts and minimum data rates for receiving requests
|
||
from the client.
|
||
core:
|
||
- Fix potential memory leaks by making sure to not destroy bucket brigades
|
||
that have been created by earlier filters.
|
||
- Return APR_EOF if request body is shorter than the length announced by the
|
||
client. PR 33098
|
||
- Preserve Port information over internal redirects PR 35999
|
||
- Build: fix --with-module to work as documented PR 43881
|
||
worker:
|
||
- Don't report server has reached MaxClients until it has. Add message when
|
||
server gets within MinSpareThreads of MaxClients. PR 46996.
|
||
ab, mod_ssl:
|
||
- Restore compatibility with OpenSSL < 0.9.7g.
|
||
mod_authnz_ldap:
|
||
- Add AuthLDAPBindAuthoritative to allow Authentication to try other
|
||
providers in the case of an LDAP bind failure. PR 46608
|
||
- Failures to map a username to a DN, or to check a user password now result
|
||
in an informational level log entry instead of warning level.
|
||
mod_cache:
|
||
- Introduce the thundering herd lock, a mechanism to keep the flood of
|
||
requests at bay that strike a backend webserver as a cached entity goes
|
||
stale.
|
||
- correctly consider s-maxage in cacheability decisions.
|
||
mod_disk_cache, mod_mem_cache:
|
||
- don't cache incomplete responses, per RFC 2616, 13.8. PR15866.
|
||
mod_charset_lite:
|
||
- Honor 'CharsetOptions NoImplicitAdd'.
|
||
mod_filter:
|
||
- fix FilterProvider matching where "dispatch" string doesn't exist. PR 48054
|
||
mod_include:
|
||
- Allow fine control over the removal of Last-Modified and ETag headers
|
||
within the INCLUDES filter, making it possible to cache responses if
|
||
desired. Fix the default value of the SSIAccessEnable directive.
|
||
mod_ldap:
|
||
- If LDAPSharedCacheSize is too small, try harder to purge some cache
|
||
entries and log a warning. Also increase the default LDAPSharedCacheSize
|
||
to 500000. This is a more realistic size suitable for the default values
|
||
of 1024 for LdapCacheEntries/LdapOpCacheEntries. PR 46749.
|
||
mod_log_config:
|
||
- Add the R option to log the handler used within the request.
|
||
mod_mime:
|
||
- Make RemoveType override the info from TypesConfig. PR 38330.
|
||
- Detect invalid use of MultiviewsMatch inside Location and LocationMatch
|
||
sections. PR 47754.
|
||
mod_negotiation:
|
||
- Preserve query string over multiviews negotiation. This buglet was fixed
|
||
for type maps in 2.2.6, but the same issue affected multiviews and was
|
||
overlooked. PR 33112
|
||
mod_proxy:
|
||
- unable to connect to a backend is SERVICE_UNAVAILABLE, rather than
|
||
BAD_GATEWAY or (especially) NOT_FOUND. PR 46971
|
||
mod_proxy, mod_proxy_http:
|
||
- Support remote https proxies by using HTTP CONNECT. PR 19188.
|
||
mod_proxy_http:
|
||
- Make sure that when an ErrorDocument is served from a reverse proxied URL,
|
||
that the subrequest respects the status of the original request. This
|
||
brings the behaviour of proxy_handler in line with default_handler. PR
|
||
47106.
|
||
mod_proxy_ajp:
|
||
- Really regard the operation a success, when the client aborted the
|
||
connection. In addition adjust the log message if the client aborted the
|
||
connection.
|
||
mod_rewrite:
|
||
- Make sure that a hostname:port isn't fully qualified if the request is a
|
||
CONNECT request. PR 47928
|
||
- Add scgi scheme detection.
|
||
mod_ssl:
|
||
- Fix a potential I/O hang if a long list of trusted CAs is configured for
|
||
client cert auth. PR 46952.
|
||
- When extracting certificate subject/issuer names to the SSL_*_DN_*
|
||
variables, handle RDNs with duplicate tags by exporting multiple
|
||
varialables with an "_n" integer suffix. PR 45875.
|
||
- obsolete patch CVE-2009-3555-2.2.patch removed
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Mar 5 09:29:10 UTC 2010 - coolo@novell.com
|
||
|
||
- readd whitespace removed by autobuild
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 16 10:56:35 CET 2009 - jengelh@medozas.de
|
||
|
||
- package documentation as noarch
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Nov 7 11:30:06 UTC 2009 - poeml@cmdline.net
|
||
|
||
- add patch for CVE-2009-3555 (cve.mitre.org)
|
||
http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch
|
||
http://mail-archives.apache.org/mod_mbox/httpd-announce/200911.mbox/%3c20091107013220.31376.qmail@minotaur.apache.org%3e
|
||
A partial fix for the TLS renegotiation prefix injection attack by rejecting
|
||
any client-initiated renegotiations. Any configuration which requires
|
||
renegotiation for per-directory/location access control is still vulnerable,
|
||
unless using OpenSSL >= 0.9.8l.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 26 12:48:11 UTC 2009 - poeml@cmdline.net
|
||
|
||
- update to 2.2.14:
|
||
*) SECURITY: CVE-2009-2699 (cve.mitre.org)
|
||
Fixed in APR 1.3.9. Faulty error handling in the Solaris pollset support
|
||
(Event Port backend) which could trigger hangs in the prefork and event
|
||
MPMs on that platform. PR 47645. [Jeff Trawick]
|
||
*) SECURITY: CVE-2009-3095 (cve.mitre.org)
|
||
mod_proxy_ftp: sanity check authn credentials.
|
||
[Stefan Fritsch <sf fritsch.de>, Joe Orton]
|
||
*) SECURITY: CVE-2009-3094 (cve.mitre.org)
|
||
mod_proxy_ftp: NULL pointer dereference on error paths.
|
||
[Stefan Fritsch <sf fritsch.de>, Joe Orton]
|
||
*) mod_proxy_scgi: Backport from trunk. [André Malo]
|
||
*) mod_ldap: Don't try to resolve file-based user ids to a DN when AuthLDAPURL
|
||
has been defined at a very high level. PR 45946. [Eric Covener]
|
||
*) htcacheclean: 19 ways to fail, 1 error message. Fixed. [Graham Leggett]
|
||
*) mod_ldap: Bring the LDAPCacheEntries and LDAPOpCacheEntries
|
||
usage() in synch with the manual and the implementation (0 and -1
|
||
both disable the cache). [Eric Covener]
|
||
*) mod_ssl: The error message when SSLCertificateFile is missing should
|
||
at least give the name or position of the problematic virtual host
|
||
definition. [Stefan Fritsch sf sfritsch.de]
|
||
*) htdbm: Fix possible buffer overflow if dbm database has very
|
||
long values. PR 30586 [Dan Poirier]
|
||
*) Add support for HTTP PUT to ab. [Jeff Barnes <jbarnesweb yahoo.com>]
|
||
*) mod_ssl: Fix SSL_*_DN_UID variables to use the 'userID' attribute
|
||
type. PR 45107. [Michael Ströder <michael stroeder.com>,
|
||
Peter Sylvester <peter.sylvester edelweb.fr>]
|
||
*) mod_cache: Add CacheIgnoreURLSessionIdentifiers directive to ignore
|
||
defined session identifiers encoded in the URL when caching.
|
||
[Ruediger Pluem]
|
||
*) mod_mem_cache: fix seg fault under load due to pool concurrency problem
|
||
PR: 47672 [Dan Poirier <poirier pobox.com>]
|
||
*) mod_autoindex: Correctly create an empty cell if the description
|
||
for a file is missing. PR 47682 [Peter Poeml <poeml suse.de>]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Aug 10 03:15:09 CEST 2009 - poeml@suse.de
|
||
|
||
- update to 2.2.13:
|
||
*) SECURITY: CVE-2009-2412 (cve.mitre.org)
|
||
Distributed with APR 1.3.8 and APR-util 1.3.9 to fix potential overflow
|
||
in pools and rmm, where size alignment was taking place.
|
||
*) mod_ssl, ab: improve compatibility with OpenSSL 1.0.0 betas. Report
|
||
warnings compiling mod_ssl against OpenSSL to the httpd developers.
|
||
*) mod_cgid: Do not add an empty argument when calling the CGI script.
|
||
PR 46380
|
||
*) Fix potential segfaults with use of the legacy ap_rputs() etc
|
||
interfaces, in cases where an output filter fails. PR 36780.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 27 22:20:11 CEST 2009 - poeml@suse.de
|
||
|
||
- update to 2.2.12:
|
||
SECURITY: CVE-2009-1891 (cve.mitre.org)
|
||
Fix a potential Denial-of-Service attack against mod_deflate or other
|
||
modules, by forcing the server to consume CPU time in compressing a
|
||
large file after a client disconnects. PR 39605.
|
||
SECURITY: CVE-2009-1195 (cve.mitre.org)
|
||
Prevent the "Includes" Option from being enabled in an .htaccess
|
||
file if the AllowOverride restrictions do not permit it.
|
||
SECURITY: CVE-2009-1890 (cve.mitre.org)
|
||
Fix a potential Denial-of-Service attack against mod_proxy in a
|
||
reverse proxy configuration, where a remote attacker can force a
|
||
proxy process to consume CPU time indefinitely.
|
||
SECURITY: CVE-2009-1191 (cve.mitre.org)
|
||
mod_proxy_ajp: Avoid delivering content from a previous request which
|
||
failed to send a request body. PR 46949
|
||
SECURITY: CVE-2009-0023, CVE-2009-1955, CVE-2009-1956 (cve.mitre.org)
|
||
The bundled copy of the APR-util library has been updated, fixing three
|
||
different security issues which may affect particular configurations
|
||
and third-party modules.
|
||
core:
|
||
- New piped log syntax: Use "||process args" to launch the given process
|
||
without invoking the shell/command interpreter. Use "|$command line"
|
||
(the default behavior of "|command line" in 2.2) to invoke using shell,
|
||
consuming an additional shell process for the lifetime of the logging
|
||
pipe program but granting additional process invocation flexibility.
|
||
- prefork: Fix child process hang during graceful restart/stop in
|
||
configurations with multiple listening sockets. PR 42829.
|
||
- Translate the status line to ASCII on EBCDIC platforms in
|
||
ap_send_interim_response() and for locally generated "100
|
||
Continue" responses.
|
||
- CGI: return 504 (Gateway timeout) rather than 500 when a
|
||
script times out before returning status line/headers. PR 42190
|
||
- prefork: Log an error instead of segfaulting when child startup fails
|
||
due to pollset creation failures. PR 46467.
|
||
- core/utils: Enhance ap_escape_html API to support escaping non-ASCII chars
|
||
- Set Listen protocol to "https" if port is set to 443 and no proto is specified
|
||
(as documented but not implemented). PR 46066
|
||
- Output -M and -S dumps (modules and vhosts) to stdout instead of stderr.
|
||
PR 42571 and PR 44266 (dup).
|
||
mod_alias:
|
||
- check sanity in Redirect arguments. PR 44729
|
||
- Ensure Redirect emits HTTP-compliant URLs. PR 44020
|
||
mod_authnz_ldap:
|
||
- Reduce number of initialization debug messages and make
|
||
information more clear. PR 46342
|
||
mod_cache:
|
||
- Introduce 'no-cache' per-request environment variable to
|
||
prevent the saving of an otherwise cacheable response.
|
||
- Correctly save Content-Encoding of cachable entity. PR 46401
|
||
- When an explicit Expires or Cache-Control header is set, cache
|
||
normally non-cacheable response statuses. PR 46346.
|
||
mod_cgid:
|
||
- fix segfault problem on solaris. PR 39332
|
||
mod_disk_cache:
|
||
- The module now turns off sendfile support if 'EnableSendfile
|
||
off' is defined globally. PR 41218.
|
||
mod_disk_cache/mod_mem_cache:
|
||
- Fix handling of CacheIgnoreHeaders directive to correctly
|
||
remove headers before storing them.
|
||
mod_deflate:
|
||
- revert changes in 2.2.8 that caused an invalid etag to be
|
||
emitted for on-the-fly gzip content-encoding. PR 39727 will
|
||
require larger fixes and this fix was far more harmful than
|
||
the original code. PR 45023.
|
||
mod_ext_filter:
|
||
- fix error handling when the filter prog fails to start, and
|
||
introduce an onfail configuration option to abort the request
|
||
or to remove the broken filter and continue. PR 41120
|
||
mod_include:
|
||
- fix potential segfault when handling back references on an
|
||
empty SSI variable.
|
||
- Prevent a case of SSI timefmt-smashing with filter chains
|
||
including multiple INCLUDES filters. PR 39369
|
||
- support generating non-ASCII characters as entities in SSI PR
|
||
25202
|
||
mod_ldap:
|
||
- Avoid a segfault when result->rc is checked in
|
||
uldap_connection_init when result is NULL. This could happen
|
||
if LDAP initialization failed. PR 45994.
|
||
mod_negotiation:
|
||
- Escape pathes of filenames in 406 responses to avoid HTML
|
||
injections and HTTP response splitting. PR 46837.
|
||
mod_proxy:
|
||
- Complete ProxyPassReverse to handle balancer URL's. Given;
|
||
BalancerMember balancer://alias http://example.com/foo
|
||
ProxyPassReverse /bash balancer://alias/bar backend url
|
||
http://example.com/foo/bar/that is now translated /bash/that
|
||
mod_proxy_ajp:
|
||
- Check more strictly that the backend follows the AJP protocol.
|
||
- Forward remote port information by default.
|
||
mod_proxy_http:
|
||
- fix Host: header for literal IPv6 addresses. PR 47177
|
||
- fix case sensitivity checking transfer encoding PR 47383
|
||
mod_rewrite:
|
||
- Remove locking for writing to the rewritelog. PR 46942
|
||
- Fix the error string returned by RewriteRule. RewriteRule
|
||
returned "RewriteCond: bad flag delimiters" when the 3rd
|
||
argument of RewriteRule was not started with "[" or not ended
|
||
with "]". PR 45082
|
||
- When evaluating a proxy rule in directory context, do escape
|
||
the filename by default. PR 46428
|
||
- Introduce DiscardPathInfo|DPI flag to stop the troublesome way
|
||
that per-directory rewrites append the previous notion of
|
||
PATH_INFO to each substitution before evaluating subsequent
|
||
rules. PR38642
|
||
- fix "B" flag breakage by reverting r589343 PR 45529
|
||
mod_ssl:
|
||
- Add server name indication support (RFC 4366) and better
|
||
support for name based virtual hosts with SSL. PR 34607
|
||
- Add SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN directives
|
||
to enable stricter checking of remote server certificates.
|
||
- Add SSLRenegBufferSize directive to allow changing the size of
|
||
the buffer used for the request-body where necessary during a
|
||
per-dir renegotiation. PR 39243.
|
||
mod_substitute:
|
||
- Fix a memory leak. PR 44948
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jul 14 14:14:22 CEST 2009 - hvogel@suse.de
|
||
|
||
- Fix missing -Y option in gensslcert [bnc#416888]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 9 17:09:35 CEST 2009 - poeml@suse.de
|
||
|
||
- merge changes from openSUSE:Factory:
|
||
- trailing spaces removed from robots.txt
|
||
- moved Snakeoil certificates to separate subpackage
|
||
example-certificates [bnc#419601]
|
||
- removed outdated ca-bundle.crt
|
||
- NOT merging the change from [bnc#301380] (setting TraceEnable
|
||
Off), since there is no reason to deviate from upstream
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 9 08:52:34 CEST 2009 - poeml@suse.de
|
||
|
||
- avoid useless (and potentially irritating) messages from usermod
|
||
called in %post when updating the package - this should probably
|
||
only be run when updating from very old installs anyway.
|
||
- likewise, avoid similar useless messages about creation of the
|
||
httpd user when installing on Fedora.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue May 5 12:43:29 CEST 2009 - poeml@suse.de
|
||
|
||
- fix hyperref to the quickstart howto in the installed httpd.conf
|
||
[bnc#500938] Thanks, Frank!
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 27 16:12:46 CEST 2009 - poeml@suse.de
|
||
|
||
- add ITK MPM (apache2.2-mpm-itk-20090414-00.patch)
|
||
see http://mpm-itk.sesse.net/
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 27 11:21:43 CEST 2009 - poeml@suse.de
|
||
|
||
- buildfix (from Factory): replace "shadow" by "pwdutils" in requires
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 12 07:01:58 CET 2009 - crrodriguez@suse.de
|
||
|
||
- update apache2-vhost.template mod_php4 references [bnc#444205]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 9 15:33:40 CET 2009 - poeml@suse.de
|
||
|
||
- fixed the ed script which turns apxs into
|
||
apxs-{prefork,worker,event) to work on Fedora, by using - instead
|
||
of ^ to go "up" one line. Thereby fixing Fedora build. (Package
|
||
probably needs further tuning to fit into a Fedora environment.)
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 20 00:49:29 CET 2008 - poeml@suse.de
|
||
|
||
- update to 2.2.11:
|
||
core:
|
||
- Worker MPM: Crosscheck that idle workers are still available
|
||
before using them and thus preventing an overflow of the
|
||
worker queue which causes a SegFault. PR 45605
|
||
- Add ap_timeout_parameter_parse to public API.
|
||
- When the ap_http_header_filter processes an error bucket,
|
||
cleanup the passed brigade before returning AP_FILTER_ERROR
|
||
down the filter chain. This unambiguously ensures the same
|
||
error bucket isn't revisited
|
||
- Error responses set by filters were being coerced into 500
|
||
errors, sometimes appended to the original error response. Log
|
||
entry of: 'Handler for (null) returned invalid result code -3'
|
||
- configure: Don't reject libtool 2.x PR 44817
|
||
- Build: Correctly set SSL_LIBS during openssl detection if
|
||
pkgconfig is not available. PR 46018
|
||
mod_autoindex:
|
||
- add configuration option to insert string in HTML HEAD (IndexHeadInsert).
|
||
mod_cache:
|
||
- Convert age of cached object to seconds before comparing it to
|
||
age supplied by the request when checking whether to send a
|
||
Warning header for a stale response. PR 39713.
|
||
mod_expires:
|
||
- Do not sets negative max-age / Expires header in the past. PR 39774
|
||
mod_info:
|
||
- Was displaying the wrong value for the KeepAliveTimeout value.
|
||
mod_log_config:
|
||
- Add new LogFormat parameter, %k, which logs the number of
|
||
keepalive requests on this connection for this request. PR 45762
|
||
mod_proxy:
|
||
- Add the possibility to set the worker parameters
|
||
connectiontimeout and ping in milliseconds.
|
||
- Prevent segmentation faults by correctly adjusting the
|
||
lifetime of the buckets read from the proxy backend. PR 45792
|
||
mod_proxy_ajp:
|
||
- Do not fail if response data is sent before all request
|
||
data is read. PR 45911
|
||
- Fix wrongly formatted requests where client sets
|
||
Content-Length header, but doesn't provide a body. Servlet
|
||
container always expects that next packet is body whenever C-L
|
||
is present in the headers. This can lead to wrong
|
||
interpretation of the packets. In this case send the empty
|
||
body packet, so container can deal with that.
|
||
mod_proxy_balancer:
|
||
- Add in forced recovery for balancer members if
|
||
all are in error state.
|
||
mod_rewrite:
|
||
- Export and install the mod_rewrite.h header to ensure the optional
|
||
rewrite_mapfunc_t and ap_register_rewrite_mapfunc functions are
|
||
available to third party modules.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 17 15:45:07 CET 2008 - poeml@suse.de
|
||
|
||
- remove mod_authn_dbm and mod_suexec from the default module list.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 21 12:01:00 CET 2008 - skh@suse.de
|
||
|
||
- apache2-server-tuning.conf:
|
||
Enclose module-specific configuration in IfModule tags [bnc#440584]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 14 09:40:05 CET 2008 - poeml@suse.de
|
||
|
||
- apply Dirks fix for [bnc#444878], making the packaging of per-mpm
|
||
modules more deterministic. They'll reliably put into the
|
||
subpackage or main package now, which varied in a ping-pong way
|
||
from build to build in the past.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 29 18:38:17 CET 2008 - poeml@suse.de
|
||
|
||
- update year of copyright in rc.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 29 00:13:58 CET 2008 - poeml@suse.de
|
||
|
||
- update to 2.2.10:
|
||
SECURITY: CVE-2008-2939 (cve.mitre.org)
|
||
mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
|
||
the FTP URL. Discovered by Marc Bevand of Rapid7.
|
||
core:
|
||
- Support chroot on Unix-family platforms. PR 43596
|
||
mod_authn_alias:
|
||
- Detect during startup when AuthDigestProvider is configured to
|
||
use an incompatible provider via AuthnProviderAlias. PR 45196
|
||
mod_cgid:
|
||
- Pass along empty command line arguments from an ISINDEX query
|
||
that has consecutive '+' characters in the QUERY_STRING,
|
||
matching the behavior of mod_cgi.
|
||
mod_charset_lite:
|
||
- Avoid dropping error responses by handling meta buckets
|
||
correctly. PR 45687
|
||
mod_dav_fs:
|
||
- Retrieve minimal system information about directory entries
|
||
when walking a DAV fs, resolving a performance degradation on
|
||
Windows. PR 45464.
|
||
mod_headers:
|
||
- Prevent Header edit from processing only the first header of
|
||
possibly multiple headers with the same name and deleting the
|
||
remaining ones. PR 45333.
|
||
mod_proxy:
|
||
- Allow for smax to be 0 for balancer members so that all idle
|
||
connections are able to be dropped should they exceed ttl. PR 43371
|
||
- Add 'scolonpathdelim' parameter to allow for ';' to also be
|
||
used as a session path separator/delim PR 45158.
|
||
- Add connectiontimeout parameter for proxy workers in order to
|
||
be able to set the timeout for connecting to the backend separately.
|
||
PR 45445.
|
||
mod_proxy_http:
|
||
- Don't trigger a retry by the client if a failure to
|
||
read the response line was the result of a timeout.
|
||
- Introduce environment variable proxy-initial-not-pooled to
|
||
avoid reusing pooled connections if the client connection is an initial
|
||
connection. PR 37770.
|
||
- Do not forward requests with 'Expect: 100-continue' to
|
||
known HTTP/1.0 servers. Return 'Expectation failed' (417) instead.
|
||
mod_proxy_balancer:
|
||
- Move nonce field in the balancer manager page inside
|
||
the html form where it belongs. PR 45578.
|
||
- Add 'bybusyness' load balance method.
|
||
mod_rewrite:
|
||
- Allow Cookie option to set secure and HttpOnly flags. PR 44799
|
||
- Preserve the query string when [proxy,noescape]. PR 45247.
|
||
mod_ssl:
|
||
- implement dynamic mutex callbacks for the benefit of OpenSSL.
|
||
- Rewrite shmcb to avoid memory alignment issues. PR 42101.
|
||
- drop obsolete patch httpd-2.2.x-CVE-2008-2939.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 24 13:23:41 CEST 2008 - skh@suse.de
|
||
|
||
- apache2.firewall, apache2.ssl-firewall
|
||
Use unique name tags "HTTP Server" and "HTTPS Server" in for
|
||
SuSEFirewall2 configuration [bnc#414962]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 19 16:18:39 CEST 2008 - skh@suse.de
|
||
|
||
- add httpd-2.x.x-logresolve.patch again [bnc#210904]
|
||
- add httpd-2.2.x-CVE-2008-2939.patch [bnc#415061]:
|
||
mod_proxy_ftp: Prevent XSS attacks when using wildcards in
|
||
the path of the FTP URL. Discovered by Marc Bevand of Rapid7.
|
||
[Ruediger Pluem]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 26 22:59:55 CEST 2008 - poeml@suse.de
|
||
|
||
- drop rc.config handling (was removed in or after SuSE Linux 8.0)
|
||
- don't use fillup_insserv options which have been removed lately
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 15 11:25:47 CEST 2008 - poeml@suse.de
|
||
|
||
- fix init script LSB headers
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 25 14:36:06 CEST 2008 - poeml@suse.de
|
||
|
||
- add note to /etc/sysconfig/apache2 and /etc/init.d/apache2 about
|
||
how to set ulimits when starting the server
|
||
- undocument APACHE_BUFFERED_LOGS and APACHE_TIMEOUT in the
|
||
sysconfig template. They still work but I think it is good to
|
||
keep this stuff out of the beginner's config, first because both
|
||
features are sophisticated enough to not being tweaked in most
|
||
cases, second because it only confuses people I guess, and makes
|
||
the sysconfig file larger than necessary.
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jun 15 19:39:46 CEST 2008 - poeml@suse.de
|
||
|
||
- update to 2.2.9:
|
||
SECURITY: CVE-2008-2364 (cve.mitre.org)
|
||
mod_proxy_http: Better handling of excessive interim responses
|
||
from origin server to prevent potential denial of service and
|
||
high memory usage. Reported by Ryujiro Shibuya.
|
||
SECURITY: CVE-2007-6420 (cve.mitre.org)
|
||
mod_proxy_balancer: Prevent CSRF attacks against the
|
||
balancer-manager interface.
|
||
- htpasswd: Fix salt generation weakness. PR 31440
|
||
worker/event MPM:
|
||
- Fix race condition in pool recycling that leads to
|
||
segmentation faults under load. PR 44402
|
||
core:
|
||
- Fix address-in-use startup failure on some platforms caused by
|
||
creating an IPv4 listener which overlaps with an existing IPv6
|
||
listener.
|
||
- Add the filename of the configuration file to the warning
|
||
message about the useless use of AllowOverride. PR 39992.
|
||
- Do not allow Options ALL if not all options are allowed to be
|
||
overwritten. PR 44262
|
||
- reinstate location walk to fix config for subrequests PR 41960
|
||
- Fix garbled TRACE response on EBCDIC platforms.
|
||
- gen_test_char: add double-quote to the list of
|
||
T_HTTP_TOKEN_STOP. PR 9727
|
||
http_filters:
|
||
- Don't return 100-continue on redirects. PR 43711
|
||
- Don't return 100-continue on client error PR 43711
|
||
- Don't spin if get an error when reading the next chunk. PR 44381
|
||
- Don't add bogus duplicate Content-Language entries
|
||
suexec:
|
||
- When group is given as a numeric gid, validate it by looking up
|
||
the actual group name such that the name can be used in log entries.
|
||
PR 7862
|
||
mod_authn_dbd:
|
||
- Disambiguate and tidy database authentication error messages. PR 43210.
|
||
mod_cache:
|
||
- Handle If-Range correctly if the cached resource was stale. PR 44579
|
||
- Revalidate cache entities which have Cache-Control: no-cache
|
||
set in their response headers. PR 44511
|
||
mod_cgid:
|
||
- Explicitly set permissions of the socket (ScriptSock) shared
|
||
by mod_cgid and request processing threads, for OS'es such as
|
||
HPUX and AIX that do not use umask for AF_UNIX socket permissions.
|
||
- Don't try to restart the daemon if it fails to initialize the socket.
|
||
mod_charset_lite:
|
||
- Add TranslateAllMimeTypes sub-option to CharsetOptions,
|
||
allowing the administrator to skip the mimetype checking that
|
||
precedes translation.
|
||
mod_dav:
|
||
- Return "method not allowed" if the destination URI of a WebDAV
|
||
copy / move operation is no DAV resource. PR 44734
|
||
mod_headers:
|
||
- Add 'merge' option to avoid duplicate values within the same header.
|
||
mod_include:
|
||
- Correctly handle SSI directives split over multiple filter
|
||
mod_log_config:
|
||
- Add format options for %p so that the actual local or remote
|
||
port can be logged. PR 43415.
|
||
mod_logio:
|
||
- Provide optional function to allow modules to adjust the
|
||
bytes_in count
|
||
mod_proxy:
|
||
- Make all proxy modules nocanon aware and do not add the
|
||
query string again in this case. PR 44803.
|
||
- scoreboard: Remove unused proxy load balancer elements from scoreboard
|
||
image (not scoreboard memory itself).
|
||
- Support environment variable interpolation in reverse
|
||
proxying directives.
|
||
- Do not try a direct connection if the connection via a
|
||
remote proxy failed before and the request has a request body.
|
||
- ProxyPassReverse is now balancer aware.
|
||
- Lower memory consumption for short lived connections.
|
||
PR 44026.
|
||
- Keep connections to the backend persistent in the HTTPS case.
|
||
mod_proxy_ajp:
|
||
- Do not retry request in the case that we either failed to
|
||
sent a part of the request body or if the request is not idempotent.
|
||
PR 44334
|
||
mod_proxy_ftp:
|
||
- Fix base for directory listings. PR 27834
|
||
mod_proxy_http:
|
||
- Fix processing of chunked responses if Connection:
|
||
Transfer-Encoding is set in the response of the proxied
|
||
system. PR 44311
|
||
- Return HTTP status codes instead of apr_status_t values for
|
||
errors encountered while forwarding the request body PR 44165
|
||
mod_rewrite:
|
||
- Initialize hash needed by ap_register_rewrite_mapfunc early
|
||
enough. PR 44641
|
||
- Check all files used by DBM maps for freshness, mod_rewrite
|
||
didn't pick up on updated sdbm maps due to this. PR41190
|
||
- Don't canonicalise URLs with [P,NE] PR 43319
|
||
mod_speling:
|
||
- remove regression from 1.3/2.0 behavior and drop dependency
|
||
between mod_speling and AcceptPathInfo.
|
||
mod_ssl:
|
||
- Fix a memory leak with connections that have zlib compression
|
||
turned on. PR 44975
|
||
mod_substitute:
|
||
- The default is now flattening the buckets after each
|
||
substitution. The newly added 'q' flag allows for the quicker,
|
||
more efficient bucket-splitting if the user so
|
||
mod_unique_id:
|
||
- Fix timestamp value in UNIQUE_ID. PR 37064
|
||
ab (apache benchmark):
|
||
- Include <limits.h> earlier if available since we may need
|
||
INT_MAX (defined there on Windows) for the definition of MAX_REQUESTS.
|
||
- Improve client performance by clearing connection pool instead
|
||
- Don't stop sending a request if EAGAIN is returned, which
|
||
will only happen if both the write and subsequent wait are
|
||
returning EAGAIN, and count posted bytes correctly when the initial
|
||
write of a request is not complete. PR 10038, 38861, 39679
|
||
- Overhaul stats collection and reporting to avoid integer
|
||
truncation and time divisions within the test loop, retain
|
||
native time resolution until output, remove unused data,
|
||
consistently round milliseconds, and generally avoid losing
|
||
accuracy of calculation due to type casts. PR 44878, 44931.
|
||
- Add -r option to continue after socket receive errors.
|
||
- Do not try to read non existing response bodies of HEAD requests.
|
||
- Use a 64 bit unsigned int instead of a signed long to count the
|
||
rotatelogs:
|
||
- Log the current file size and error code/description when
|
||
failing to write to the log file.
|
||
- Added '-f' option to force rotatelogs to create the logfile as
|
||
soon as started, and not wait until it reads the first entry.
|
||
- Don't leak memory when reopening the logfile. PR 40183
|
||
- Improve atomicity when using -l and cleaup code. PR 44004
|
||
- drop obsolete patches httpd-2.1.3alpha-autoconf-2.59.dif
|
||
httpd-2.2.x-CVE-2008-1678.patch
|
||
- don't run autoreconf on SLES9
|
||
- remove the addition of -g to the CFLAGS, since the build service
|
||
handles debuginfo packages now
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jun 9 17:18:03 CEST 2008 - poeml@suse.de
|
||
|
||
- build service supports the debuginfo flag in metadata now; remove
|
||
debug_package macro from the specfile therefore.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon May 26 16:55:37 CEST 2008 - skh@suse.de
|
||
|
||
- CVE-2008-1678: modules/ssl/mod_ssl.c (ssl_cleanup_pre_config):
|
||
Remove the call to CRYPTO_cleanup_all_ex_data here, fixing a
|
||
per-connection memory leak which occurs if the client indicates
|
||
support for a compression algorithm in the initial handshake, and
|
||
mod_ssl is linked against OpenSSL >= 0.9.8f. [bnc#392096]
|
||
httpd-2.2.x-CVE-2008-1678.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Thu May 15 01:58:08 CEST 2008 - poeml@suse.de
|
||
|
||
- fix build on Mandriva 2007, by escaping commented %build macro
|
||
- make filelist of man pages independant of the compression method
|
||
(gz, bz2, lzma)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 18 11:55:14 CEST 2008 - poeml@suse.de
|
||
|
||
- fix from Factory:
|
||
- remove dir /usr/share/omc/svcinfo.d as it is provided now
|
||
by filesystem
|
||
- remove obsolete httpd-2.2.x.doublefree.patch file, which isn't
|
||
used since quite some time since the issue is resolved.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Apr 17 17:58:02 CEST 2008 - poeml@suse.de
|
||
|
||
- new implementation of sysconf_addword, using sed instead of ed.
|
||
Moving it from the -utils subpackage into the parent package,
|
||
where it's actually needed. If sysconf_addword is already present
|
||
in the system, it is preferred (by PATH). That's because the tool
|
||
has been integrated into aaa_base.rpm with openSUSE 11.0.
|
||
Removing the requires on the ed package. [bnc#377131]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Mar 12 14:29:04 CET 2008 - poeml@suse.de
|
||
|
||
- require ed package, since ed is needed by sysconf_addword, which
|
||
in turn is used by a2enmod/a2enflag
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 29 14:06:52 CET 2008 - poeml@suse.de
|
||
|
||
- better documentation how to enable SSL in /etc/sysconfig/apache2
|
||
- quickstart readme: the link to the openSUSE wiki is about to move
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 19 13:14:45 CET 2008 - poeml@suse.de
|
||
|
||
- add "127.0.0.1" to the local access list in mod_status.conf,
|
||
because on some systems "localhost" seems to resolve only to IPv6
|
||
localhost
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Feb 2 05:37:34 CET 2008 - crrodriguez@suse.de
|
||
|
||
- upstream 2.2.8
|
||
SECURITY: CVE-2007-6421 (cve.mitre.org)
|
||
mod_proxy_balancer: Correctly escape the worker route and the worker
|
||
redirect string in the HTML output of the balancer manager.
|
||
Reported by SecurityReason.
|
||
SECURITY: CVE-2007-6422 (cve.mitre.org)
|
||
Prevent crash in balancer manager if invalid balancer name is passed
|
||
as parameter. Reported by SecurityReason.
|
||
SECURITY: CVE-2007-6388 (cve.mitre.org)
|
||
mod_status: Ensure refresh parameter is numeric to prevent
|
||
a possible XSS attack caused by redirecting to other URLs.
|
||
Reported by SecurityReason.
|
||
SECURITY: CVE-2007-5000 (cve.mitre.org)
|
||
mod_imagemap: Fix a cross-site scripting issue. Reported by JPCERT.
|
||
SECURITY: CVE-2008-0005 (cve.mitre.org)
|
||
Introduce the ProxyFtpDirCharset directive, allowing the administrator
|
||
to identify a default, or specific servers or paths which list their
|
||
contents in other-than ISO-8859-1 charset (e.g. utf-8).
|
||
mod_autoindex:
|
||
- Generate valid XHTML output by adding the xhtml namespace. PR 43649
|
||
mod_charset_lite:
|
||
- Don't crash when the request has no associated filename.
|
||
mod_dav:
|
||
- Fix evaluation of If-Match * and If-None-Match * conditionals. PR 38034
|
||
- Adjust etag generation to produce identical results on 32-bit
|
||
and 64-bit platforms and avoid a regression with conditional PUT's on lock
|
||
and etag. PR 44152.
|
||
mod_deflate:
|
||
- initialise inflate-out filter correctly when the first brigade
|
||
contains no data buckets. PR 43512
|
||
mod_disk_cache:
|
||
- Delete temporary files if they cannot be renamed to their final
|
||
name.
|
||
mod_filter:
|
||
- Don't segfault on (unsupported) chained FilterProvider usage. PR 43956
|
||
mod_include:
|
||
- Add an "if" directive syntax to test whether an URL is
|
||
accessible, and if so, conditionally display content. This
|
||
allows a webmaster to hide a link to a private page when the
|
||
user has no access to that page.
|
||
mod_ldap:
|
||
- Try to establish a new backend LDAP connection when the
|
||
Microsoft LDAP client library returns LDAP_UNAVAILABLE, e.g.
|
||
after the LDAP server has closed the connection due to a
|
||
timeout. PR 39095
|
||
- Give callers a reference to data copied into the request pool
|
||
instead of references directly into the cache PR 43786
|
||
- Stop passing a reference to pconf around for (limited) use
|
||
during request processing, avoiding possible memory corruption
|
||
and crashes.
|
||
mod_proxy:
|
||
- Canonicalisation improvements. Add "nocanon" keyword to
|
||
ProxyPass, to suppress URI-canonicalisation in a reverse proxy. Also,
|
||
don't escape/unescape forward-proxied URLs. PR 41798, 42592
|
||
- Don't by default violate RFC2616 by setting Max-Forwards when
|
||
the client didn't send it to us. Leave that as a
|
||
configuration option. PR 16137
|
||
- Fix persistent backend connections. PR 43472
|
||
- escape error-notes correctly PR 40952
|
||
- check ProxyBlock for all blocked addresses PR 36987
|
||
- Don't lose bytes when a response line arrives in small chunks.
|
||
PR 40894
|
||
mod_proxy_ajp:
|
||
- Use 64K as maximum AJP packet size. This is the maximum length
|
||
we can squeeze inside the AJP message packet.
|
||
- Ignore any ajp13 flush packets received before we send the
|
||
response headers. See Tomcat PR 43478.
|
||
- Differentiate within AJP between GET and HEAD requests. PR 43060
|
||
mod_proxy_balancer:
|
||
- Do not reset lbstatus, lbfactor and lbset when starting a new
|
||
child. PR 39907
|
||
mod_proxy_http:
|
||
- Remove Warning headers with wrong date PR 16138
|
||
- Correctly parse all Connection headers in proxy. PR 43509
|
||
- add Via header correctly (if enabled) to response, even where
|
||
other Via headers exist. PR 19439
|
||
- Correctly forward unexpected interim (HTTP 1xx) responses from
|
||
the backend according to RFC2616. But make it configurable in
|
||
case something breaks on it. PR 16518
|
||
- strip hop-by-hop response headers PR 43455
|
||
- Propagate Proxy-Authorization header correctly. PR 25947
|
||
- Don't segfault on bad line in FTP listing PR 40733
|
||
mod_rewrite:
|
||
- Add option to suppress URL unescaping PR 34602
|
||
- Add the novary flag to RewriteCond.
|
||
mod_substitute:
|
||
- Added a new output filter, which performs inline response
|
||
content pattern matching (including regex) and substitution.
|
||
mod_ssl:
|
||
- Fix handling of the buffered request body during a per-location
|
||
renegotiation, when an internal redirect occurs. PR 43738.
|
||
- Fix SSL client certificate extensions parsing bug. PR 44073.
|
||
- Prevent memory corruption of version string. PR 43865, 43334
|
||
mod_status:
|
||
- Add SeeRequestTail directive, which determines if
|
||
ExtendedStatus displays the 1st 63 characters of the request
|
||
or the last 63. Useful for those requests with large string
|
||
lengths and which only vary with the last several characters.
|
||
event MPM:
|
||
- Add support for running under mod_ssl, by reverting to the
|
||
Worker MPM behaviors, when run under an input filter that buffers
|
||
its own data.
|
||
core:
|
||
- Fix regression in 2.2.7 in chunk filtering with massively
|
||
chunked requests.
|
||
- Lower memory consumption of ap_r* functions by reusing the
|
||
brigade instead of recreating it during each filter pass.
|
||
- Lower memory consumption in case that flush buckets are passed
|
||
thru the chunk filter as last bucket of a brigade. PR 23567.
|
||
- Fix broken chunk filtering that causes all non blocking reads
|
||
to be converted into blocking reads. PR 19954, 41056.
|
||
- Change etag generation to produce identical results on 32-bit
|
||
and 64-bit platforms. PR 40064.
|
||
- Handle unrecognised transfer-encodings. PR 43882
|
||
- Avoid some unexpected connection closes by telling the client
|
||
that the connection is not persistent if the MPM process
|
||
handling the request is already exiting when the response
|
||
header is built.
|
||
- fix possible crash at startup in case of nonexistent
|
||
DocumentRoot. PR 39722
|
||
- http_core: OPTIONS * no longer maps to local storage or URI
|
||
space. Note that unlike previous versions, OPTIONS * no longer
|
||
returns an Allow: header. PR 43519
|
||
- scoreboard: improve error message on apr_shm_create failure PR
|
||
40037
|
||
- Don't send spurious "100 Continue" response lines. PR 38014
|
||
- http_protocol:
|
||
- Escape request method in 413 error reporting. Determined to
|
||
be not generally exploitable, but a flaw in any case. PR
|
||
44014
|
||
- Add "DefaultType none" option. PR 13986 and PR 16139
|
||
- Escape request method in 405 error reporting. This has no
|
||
security impact since the browser cannot be tricked into
|
||
sending arbitrary method strings.
|
||
- Various code cleanups. PR 38699, 39518, 42005, 42006, 42007, 42008, 42009
|
||
- Add explicit charset to the output of various modules to work
|
||
around possible cross-site scripting flaws affecting web
|
||
browsers that do not derive the response character set as
|
||
required by RFC2616. One of these reported by SecurityReason
|
||
- rotatelogs: Change command-line parsing to report more types
|
||
of errors. Allow local timestamps to be used when rotating based
|
||
on file size.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 12 20:11:37 CEST 2007 - poeml@suse.de
|
||
|
||
- fix graceful-restart. Wait until the pidfile is gone, but don't
|
||
wait for the parent to disappear. It stays there, after closing
|
||
the listen ports.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 12 15:49:15 CEST 2007 - poeml@suse.de
|
||
|
||
- use debug_package macro only on suse, because it breaks the build
|
||
on Mandriva
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 12 13:41:16 CEST 2007 - poeml@suse.de
|
||
|
||
- don't configure in maintainer-mode. It not only enables compile
|
||
time warnings, but also adds AP_DEBUG into the mix which causes
|
||
enablement of debug code which is not wanted in production
|
||
builds.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 10 17:32:56 CEST 2007 - poeml@suse.de
|
||
|
||
- upstream 2.2.6
|
||
SECURITY: CVE-2007-3847 (cve.mitre.org)
|
||
mod_proxy: Prevent reading past the end of a buffer when parsing
|
||
date-related headers. PR 41144.
|
||
SECURITY: CVE-2007-1863 (cve.mitre.org)
|
||
mod_cache: Prevent a segmentation fault if attributes are listed in a
|
||
Cache-Control header without any value.
|
||
SECURITY: CVE-2007-3304 (cve.mitre.org)
|
||
prefork, worker, event MPMs: Ensure that the parent process cannot
|
||
be forced to kill processes outside its process group.
|
||
SECURITY: CVE-2006-5752 (cve.mitre.org)
|
||
mod_status: Fix a possible XSS attack against a site with a public
|
||
server-status page and ExtendedStatus enabled, for browsers which
|
||
perform charset "detection". Reported by Stefan Esser.
|
||
SECURITY: CVE-2007-1862 (cve.mitre.org)
|
||
mod_mem_cache: Copy headers into longer lived storage; header names and
|
||
values could previously point to cleaned up storage. PR 41551.
|
||
mod_alias:
|
||
- Accept path components (URL part) in Redirects. PR 35314.
|
||
mod_authnz_ldap:
|
||
- Don't return HTTP_UNAUTHORIZED during authorization when
|
||
LDAP authentication is configured but we haven't seen any
|
||
'Require ldap-*' directives, allowing authorization to be passed to lower
|
||
level modules (e.g. Require valid-user) PR 43281
|
||
mod_autoindex:
|
||
- Add in Type and Charset options to IndexOptions
|
||
directive. This allows the admin to explicitly set the
|
||
content-type and charset of the generated page and is therefore
|
||
a viable workaround for buggy browsers affected by CVE-2007-4465
|
||
mod_cache:
|
||
- Remove expired content from cache that cannot be revalidated.
|
||
PR 30370.
|
||
- Do not set Date or Expires when they are missing from the
|
||
original response or are invalid.
|
||
- Correctly handle HEAD requests on expired cache content. PR
|
||
41230.
|
||
- Let Cache-Control max-age set the expiration of the cached
|
||
representation if Expires is not set.
|
||
- Allow caching of requests with query arguments when
|
||
Cache-Control max-age is explicitly specified.
|
||
- Use the same cache key throughout the whole request processing
|
||
to handle escaped URLs correctly. PR 41475.
|
||
- Add CacheIgnoreQueryString directive. PR 41484.
|
||
- While serving a cached entity ensure that filters that have
|
||
been applied to this cached entity before saving it to the
|
||
cache are not applied again. PR 40090.
|
||
- Correctly cache objects whose URL query string has been
|
||
modified by mod_rewrite. PR 40805.
|
||
mod_cgi, mod_cgid:
|
||
- Fix use of CGI scripts as ErrorDocuments. PR 39710.
|
||
mod_dbd:
|
||
- Introduce configuration groups to allow inheritance by virtual
|
||
hosts of database configurations from the main server.
|
||
Determine the minimal set of distinct configurations and share
|
||
connection pools whenever possible. Allow virtual hosts to
|
||
override inherited SQL statements. PR 41302.
|
||
- Create memory sub-pools for each DB connection and close DB
|
||
connections in a pool cleanup function. Ensure prepared
|
||
statements are destroyed before DB connection is closed. When
|
||
using reslists, prevent segfaults when child processes exit,
|
||
and stop memory leakage of ap_dbd_t structures. Avoid use of
|
||
global s->process->pool, which isn't destroyed by exiting
|
||
child processes in most multi-process MPMs. PR 39985.
|
||
- Handle error conditions in dbd_construct() properly. Simplify
|
||
ap_dbd_open() and use correct arguments to apr_dbd_error()
|
||
when non-threaded. Register correct cleanup data in
|
||
non-threaded ap_dbd_acquire() and ap_dbd_cacquire(). Clean up
|
||
configuration data and merge function. Use ap_log_error()
|
||
wherever possible.
|
||
- Stash DBD connections in request_config of initial request
|
||
only, or else sub-requests and internal redirections may cause
|
||
entire DBD pool to be stashed in a single HTTP request.
|
||
mod_deflate:
|
||
- don't try to process metadata buckets as data. what should
|
||
have been a 413 error was logged as a 500 and a blank screen
|
||
appeared at the browser.
|
||
- fix protocol handling in deflate input filter PR 23287
|
||
mod_disk_cache:
|
||
- Allow Vary'd responses to be refreshed properly.
|
||
mod_dumpio:
|
||
- Fix for correct dumping of traffic on EBCDIC hosts Data had
|
||
been incorrectly converted twice, resulting in garbled log
|
||
output.
|
||
mod_expires:
|
||
- don't crash on bad configuration data PR 43213
|
||
mod_filter:
|
||
- fix integer comparisons in dispatch rules PR 41835
|
||
- fix merging of ! and = in FilterChain PR 42186
|
||
mod_headers:
|
||
- Allow % at the end of a Header value. PR 36609.
|
||
mod_info:
|
||
- mod_info outputs invalid XHTML 1.0 transitional. PR 42847
|
||
mod_ldap:
|
||
- Avoid possible crashes, hangs, and busy loops due to improper
|
||
merging of the cache lock in vhost config PR 43164
|
||
mod_ldap:
|
||
- Remove the hardcoded size limit parameter for
|
||
ldap_search_ext_s and replace it with an APR_ defined value
|
||
that is set according to the LDAP SDK being used.
|
||
mod_mem_cache:
|
||
- Increase the minimum and default value for MCacheMinObjectSize
|
||
from 0 to 1, as a MCacheMinObjectSize of 0 does not make sense
|
||
and leads to a division by zero. PR 40576.
|
||
mod_negotiation:
|
||
- preserve Query String in resolving a type map PR 33112
|
||
mod_proxy:
|
||
- mod_proxy_http: accept proxy-sendchunked/proxy-sendchunks as
|
||
synonymous. PR 43183
|
||
- Ensure that at least scheme://hostname[:port] matches between
|
||
worker and URL when searching for the best fitting worker for
|
||
a given URL. PR 40910
|
||
- Improve network performance by setting APR_TCP_NODELAY
|
||
(disable Nagle algorithm) on sockets if implemented. PR 42871
|
||
- Add a missing assignment in an error checking code path. PR 40865
|
||
- don't URLencode tilde in path component PR 38448
|
||
- enable Ignore Errors option on ProxyPass Status. PR 43167
|
||
- Allow to use different values for sessionid in url encoded id
|
||
and cookies. PR 41897.
|
||
- Fix the 503 returned when session route does not match any of
|
||
the balancer members.
|
||
- Added ProxyPassMatch directive, which is similar to ProxyPass
|
||
but takes a regex local path prefix.
|
||
- Print the correct error message for erroneous configured
|
||
ProxyPass directives. PR 40439.
|
||
- Fix some proxy setting inheritance problems (eg:
|
||
ProxyTimeout). PR 11540.
|
||
- proxy/ajp_header.c: Fixed header token string comparisons
|
||
Matching of header tokens failed to include the trailing NIL
|
||
byte and could misinterpret a longer header token for a
|
||
shorter. Additionally, a "Content-Type" comparison was made
|
||
case insensitive.
|
||
- proxy/ajp_header.c: Backport of an AJP protocol fix for EBCDIC
|
||
On EBCDIC machines, the status_line string was incorrectly
|
||
converted twice.
|
||
mod_proxy_connect:
|
||
- avoid segfault on DNS lookup failure. PR 40756
|
||
mod_proxy_http:
|
||
- HTTP proxy ProxyErrorOverride: Leave 1xx and 3xx responses
|
||
alone. Only processing of error responses (4xx, 5xx) will be
|
||
altered. PR 39245.
|
||
- Don't try to read body of a HEAD request before responding. PR 41644
|
||
- Handle request bodies larger than 2 GB by converting the
|
||
Content-Length header of the request correctly. PR 40883.
|
||
mod_ssl:
|
||
- Fix spurious hostname mismatch warning for valid wildcard
|
||
certificates. PR 37911.
|
||
- Version reporting update; displays 'compiled against' Apache
|
||
and build-time SSL Library versions at loglevel [info], while
|
||
reporting the run-time SSL Library version in the server info
|
||
tags. Helps to identify a mod_ssl built against one flavor of
|
||
OpenSSL but running against another (also adds SSL-C version
|
||
number reporting.)
|
||
- initialize thread locks before initializing the hardware
|
||
acceleration library, so the latter can make use of the
|
||
former. PR 20951.
|
||
core:
|
||
- Do not replace a Date header set by a proxied backend server. PR 40232
|
||
- log core: ensure we use a special pool for stderr logging, so that
|
||
the stderr channel remains valid from the time plog is destroyed,
|
||
until the time the open_logs hook is called again.
|
||
- main core: Emit errors during the initial apr_app_initialize()
|
||
or apr_pool_create() (when apr-based error reporting is not ready).
|
||
- log core: fix the new piped logger case where we couldn't connect
|
||
the replacement stderr logger's stderr to the NULL stdout stream.
|
||
Continue in this case, since the previous alternative of no error
|
||
logging at all (/dev/null) is far worse.
|
||
- Correct a regression since 2.0.x in the handling of AllowOverride
|
||
Options. PR 41829.
|
||
- Unix MPMs: Catch SIGFPE so that exception hooks and CoreDumpDirectory
|
||
can work after that terminating signal.
|
||
- mod_so: Provide more helpful LoadModule feedback when an error occurs.
|
||
misc:
|
||
- mime.types: Many updates to sync with IANA registry and common
|
||
unregistered types that the owners refuse to register. Admins
|
||
are encouraged to update their installed mime.types file. PR:
|
||
35550, 37798, 39317, 31483
|
||
- mime.types: add Registered Javascript/ECMAScript MIME types
|
||
(RFC4329) PR 40299
|
||
- htdbm: Enable crypt support on platforms with crypt() but not
|
||
<crypt.h>, such as z/OS.
|
||
- ab.c: Correct behavior of HTTP request headers sent by ab in
|
||
presence of -H command-line overrides. PR 31268, 26554.
|
||
- ab.c: The apr_port_t type is unsigned, but ab was using a
|
||
signed format code in its reports. PR 42070.
|
||
- drop obsolete patches apache2-mod_cache-CVE-2007-1863.patch
|
||
apache2-mod_status-CVE-2006-5752.patch
|
||
httpd-2.2.4-mod_autoindex-charset-r570962.patch
|
||
mod_dbd.c-issue18989-autoconnect.dif
|
||
mod_dbd.c-r571441
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 3 13:43:22 CEST 2007 - skh@suse.de
|
||
|
||
- get_module_list: replace loadmodule.conf atomically [bnc #214863]
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Sep 1 01:49:37 CEST 2007 - poeml@suse.de
|
||
|
||
- /etc/init.d/apache2: implement restart-graceful, stop-graceful
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 31 14:21:27 CEST 2007 - poeml@suse.de
|
||
|
||
- update mod_dbd to trunk version (r571441)
|
||
* apr_dbd_check_conn() just returns APR_SUCCESS or
|
||
APR_EGENERAL, so we don't actually have a driver-specific value
|
||
to pass to apr_dbd_error(), but that's OK because most/all
|
||
drivers just ignore this value anyway
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 31 12:37:27 CEST 2007 - poeml@suse.de
|
||
|
||
- replace httpd-2.2.3-AddDirectoryIndexCharset.patch with the upstream
|
||
solution, httpd-2.2.4-mod_autoindex-charset-r570962.patch [#153557]
|
||
(backport from 2.2.6)
|
||
* Merge r570532, r570535, r570558 from trunk:
|
||
IndexOptions ContentType=text/html Charset=UTF-8 magic.
|
||
http://svn.apache.org/viewvc?rev=570962&view=rev
|
||
http://issues.apache.org/bugzilla/show_bug.cgi?id=42105
|
||
This means that the AddDirectoryIndexCharset is no longer
|
||
available. Instead, IndexOptions Charset=xyz can be used.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 31 11:42:58 CEST 2007 - poeml@suse.de
|
||
|
||
- remove libexpat-devel in the build service version of the package
|
||
- apply apache2-mod_cache-CVE-2007-1863.patch (patch 152) in the
|
||
buildservice package
|
||
- don't apply mod_dbd.c-issue18989-autoconnect.dif, since it
|
||
patches only modules/database/mod_dbd.c which is replaced with
|
||
trunk version anyway
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 23 11:27:19 CEST 2007 - mskibbe@suse.de
|
||
|
||
- Bug 289996 - VUL-0: mod_status XSS in public server status page
|
||
- Bug 289997 - VUL-0: apache2: mod_cache remote denial of service
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 18 16:04:05 CEST 2007 - skh@suse.de
|
||
|
||
- split off apache2-utils subpackage, containing all helper tools that
|
||
are useful for system administrators in general (b.n.c. #272292 and
|
||
FATE #302059)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 29 19:14:16 CEST 2007 - dmueller@suse.de
|
||
|
||
- add zlib-devel to BuildRequires
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Mar 23 08:55:47 CET 2007 - poeml@suse.de
|
||
|
||
- add mod_dbd.c from trunk (r512038), the version we run ourselves
|
||
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/database/mod_dbd.c?view=log
|
||
- add mod_dbd.c-issue18989-autoconnect.dif, but disabled. It
|
||
applies to 2.2.4 mod_dbd.c but not to the trunk version
|
||
- build mod_version
|
||
- fix documentation link in apache2-httpd.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 20 10:47:18 CET 2007 - mskibbe@suse.de
|
||
|
||
- add firewall file for ssl (#246929)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 19 12:44:22 CET 2007 - mskibbe@suse.de
|
||
|
||
- Apache - Support for FATE #300687: Ports for SuSEfirewall added
|
||
via packages (#246929)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 26 12:44:04 CET 2007 - poeml@suse.de
|
||
|
||
- the QUICKSTART Readmes have been moved to
|
||
http://www.opensuse.org/Apache
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 22 11:24:32 CET 2007 - poeml@suse.de
|
||
|
||
- point out better in README.QUICKSTART.SSL that a vhost needs to
|
||
be created
|
||
- fixes to README.QUICKSTART.WebDAV
|
||
- updated email addresses (now there is apache@suse.de)
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jan 20 17:16:20 CET 2007 - poeml@suse.de
|
||
|
||
- add httpd-2.2.x.doublefree.patch, backport of
|
||
http://svn.apache.org/viewvc?diff_format=h&view=rev&revision=496831
|
||
See http://issues.apache.org/bugzilla/show_bug.cgi?id=39985
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jan 18 22:00:48 CET 2007 - poeml@suse.de
|
||
|
||
- create debuginfo package in the buildservice
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 12 14:25:51 CET 2007 - mskibbe@suse.de
|
||
|
||
- change path to service cml document (fate #301708)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 9 15:59:42 CET 2007 - poeml@suse.de
|
||
|
||
- upstream 2.2.4
|
||
mod_authnz_ldap:
|
||
- Add an AuthLDAPRemoteUserAttribute directive. If set,
|
||
REMOTE_USER will be set to this attribute, rather than the
|
||
username supplied by the user. Useful for example when you
|
||
want users to log in using an email address, but need to
|
||
supply a userid instead to the backend.
|
||
mod_cache:
|
||
- From RFC3986 (section 6.2.3.) if a URI contains an authority
|
||
component and an empty path, the empty path is to be
|
||
equivalent to "/". It explicitly cites the following four URIs
|
||
as equivalents:
|
||
http://example.com
|
||
http://example.com/
|
||
http://example.com:/
|
||
http://example.com:80/
|
||
- Eliminate a bogus error in the log when a filter returns
|
||
AP_FILTER_ERROR.
|
||
- Don't cache requests with a expires date in the past;
|
||
otherwise mod_cache will always try to cache the URL. This bug
|
||
might lead to numerous rename() errors on win32 if the URL was
|
||
previously cached.
|
||
mod_cgi and mod_cgid:
|
||
- Don't use apr_status_t error return from input filters as HTTP
|
||
return value from the handler. PR 31579.
|
||
mod_dbd:
|
||
- share per-request database handles across subrequests and
|
||
internal redirects
|
||
- key connection pools to virtual hosts correctly even when
|
||
ServerName is unset/unavailable
|
||
mod_deflate:
|
||
- Rework inflate output and deflate output filter to fix several
|
||
issues: Incorrect handling of flush buckets, potential memory
|
||
leaks, excessive memory usage in inflate output filter for
|
||
large compressed content. PR 39854.
|
||
mod_disk_cache:
|
||
- Make sure that only positive integers are accepted for the
|
||
CacheMaxFileSize and CacheMinFileSize parameters in the config
|
||
file. PR39380.
|
||
mod_dumpio:
|
||
- Allow mod_dumpio to log at other than DEBUG levels via the new
|
||
DumpIOLogLevel directive.
|
||
mod_echo:
|
||
- Fix precedence problem in if statement. PR 40658.
|
||
mod_ext_filter:
|
||
- Handle filter names which include capital letters. PR 40323.
|
||
mod_headers:
|
||
- Support regexp-based editing of HTTP headers.
|
||
mod_mime_magic:
|
||
- Fix precedence problem in if statement. PR 40656.
|
||
mod_mem_cache:
|
||
- Memory leak fix: Unconditionally free the buffer.
|
||
- Convert mod_mem_cache to use APR memory pool functions by
|
||
creating a root pool for object persistence across requests.
|
||
This also eliminates the need for custom serialization code.
|
||
mod_proxy:
|
||
- Don't try to use dead backend connection. PR 37770.
|
||
- Add explicit flushing feature. When Servlet container sends
|
||
AJP body message with size 0, this means that Servlet
|
||
container has asked for an explicit flush. Create flush bucket
|
||
in that case. This feature has been added to the recent Tomcat
|
||
versions without breaking the AJP protocol.
|
||
mod_proxy_ajp:
|
||
- Close connection to backend if reading of request body fails.
|
||
PR 40310.
|
||
- Added cping/cpong support for the AJP protocol. A new worker
|
||
directive ping=timeout will cause CPING packet to be send
|
||
expecting CPONG packet within defined timeout. In case the
|
||
backend is too busy this will fail instead sending the full
|
||
header.
|
||
mod_proxy_balancer:
|
||
- Workers can now be defined as part of a balancer cluster "set"
|
||
in which members of a lower-numbered set are preferred over
|
||
higher numbered ones.
|
||
- Workers can now be defined as "hot standby" which will only be
|
||
used if all other workers are unusable (eg: in error or
|
||
disabled). Also, the balancer-manager displays the election
|
||
count and I/O counts of all workers.
|
||
- Retry worker chosen by route / redirect worker if it is in
|
||
error state before sending "Service Temporarily Unavailable".
|
||
PR 38962.
|
||
- Extract stickysession routing information contained as
|
||
parameter in the URL correctly. PR 40400.
|
||
- Set the new environment variable BALANCER_ROUTE_CHANGED if a
|
||
worker with a route different from the one supplied by the
|
||
client had been chosen or if the client supplied no routing
|
||
information for a balancer with sticky sessions.
|
||
- Add information about the route, the sticky session and the
|
||
worker used during a request as environment variables. PR
|
||
39806.
|
||
core:
|
||
- Fix issue which could cause piped loggers to be orphaned and
|
||
never terminate after a graceful restart. PR 40651.
|
||
- Fix address-in-use startup failure caused by corruption of the
|
||
list of listen sockets in some configurations with multiple
|
||
generic Listen directives.
|
||
- Fix NONBLOCK status of listening sockets on restart/graceful
|
||
PR 37680.
|
||
- Deal with the widespread use of apr_status_t return values as
|
||
HTTP status codes, as documented in PR#31759 (a bug shared by
|
||
the default handler, mod_cgi, mod_cgid, mod_proxy, and
|
||
probably others). PR31759.
|
||
- The full server version information is now included in the
|
||
error log at startup as well as server status reports,
|
||
irrespective of the setting of the ServerTokens directive.
|
||
ap_get_server_version() is now deprecated, and is replaced by
|
||
ap_get_server_banner() and ap_get_server_description().
|
||
misc:
|
||
- Allow htcacheclean, httxt2dbm, and fcgistarter to link
|
||
apr/apr-util statically like the older support programs.
|
||
- Better detection and clean up of ldap connection that has been
|
||
terminated by the ldap server. PR 40878.
|
||
- rotatelogs: Improve error message for open failures. PR
|
||
39487.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 8 11:57:04 CET 2007 - mskibbe@suse.de
|
||
|
||
- Apache XML Service Description Document (fate #301708)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 21 10:36:14 CET 2006 - poeml@suse.de
|
||
|
||
- add patch to add charset=utf-8 to directory listings generated by
|
||
mod_autoindex, and add a directive to allow overriding the
|
||
charset (testing, needs to be discussed with upstream) [#153557]
|
||
httpd-2.2.3-AddDirectoryIndexCharset.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 20 15:58:35 CET 2006 - poeml@suse.de
|
||
|
||
- set a proper HOME (/var/lib/apache2), otherwise the server might
|
||
end up HOME=/root and some script might try to use that [#132769]
|
||
- add two notes to the QUICKSTART readmes
|
||
- don't install /etc/apache2/extra configuration since this is only
|
||
serving as an example and installed with the documentation anyway
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 26 11:13:52 CEST 2006 - poeml@suse.de
|
||
|
||
- add rpm macro for suexec_safepath
|
||
- use _bindir/_sbindir in a few places [#202355]
|
||
- remove unused /sbin/conf.d directory from build root
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 31 15:26:54 CEST 2006 - poeml@suse.de
|
||
|
||
- Enable fatal exception hook for use by diagnostic modules.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 29 16:33:59 CEST 2006 - poeml@suse.de
|
||
|
||
- move some binaries, where calling by users makes sense (dbmmanage
|
||
htdbm htdigest htpasswd), from /usr/sbin to /usr/bin [#140133]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 9 16:13:07 CEST 2006 - poeml@suse.de
|
||
|
||
- upstream 2.2.3
|
||
|SECURITY: CVE-2006-3747 (cve.mitre.org)
|
||
| mod_rewrite: Fix an off-by-one security problem in the ldap scheme
|
||
| handling. For some RewriteRules this could lead to a pointer being
|
||
| written out of bounds. Reported by Mark Dowd of McAfee.
|
||
| mod_authn_alias: Add a check to make sure that the base provider and the
|
||
| alias names are different and also that the alias has not been registered
|
||
| before. PR 40051.
|
||
| mod_authnz_ldap: Fix a problem with invalid auth error detection for LDAP
|
||
| client SDKs that don't support the LDAP_SECURITY_ERROR macro. PR 39529.
|
||
| mod_autoindex: Fix filename escaping with FancyIndexing disabled.
|
||
| PR 38910.
|
||
| mod_cache:
|
||
| - Make caching of reverse SSL proxies possible again. PR 39593.
|
||
| - Do not overwrite the Content-Type in the cache, for
|
||
| successfully revalidated cached objects. PR 39647.
|
||
| mod_charset_lite: Bypass translation when the source and dest charsets
|
||
| are the same.
|
||
| mod_dbd: Fix dependence on virtualhost configuration in
|
||
| defining prepared statements (possible segfault at startup
|
||
| in user modules such as mod_authn_dbd).
|
||
| mod_mem_cache: Set content type correctly when delivering data from
|
||
| cache. PR 39266.
|
||
| mod_speling: Add directive to deal with case corrections only
|
||
| and ignore other misspellings
|
||
| miscellaneous:
|
||
| - Add optional 'scheme://' prefix to ServerName directive,
|
||
| allowing correct determination of the canonical server URL
|
||
| for use behind a proxy or offload device handling SSL;
|
||
| fixing redirect generation in those cases. PR 33398.
|
||
| - Added server_scheme field to server_rec for above. Minor MMN bump.
|
||
| - Worker MPM: On graceless shutdown or restart, send signals
|
||
| to each worker thread to wake them up if they're polling on
|
||
| a Keep-Alive connection. PR 38737.
|
||
| - worker and event MPMs: fix excessive forking if fork() or
|
||
| child_init take a long time. PR 39275.
|
||
| - Respect GracefulShutdownTimeout in the worker and event MPMs.
|
||
| - configure: Add "--with-included-apr" flag to force use of
|
||
| the bundled version of APR at build time.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jul 4 12:20:54 CEST 2006 - poeml@suse.de
|
||
|
||
- a2enmod, a2enflag: add /usr/sbin to PATH so sysconf_addword is
|
||
found
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 23 09:52:17 CEST 2006 - poeml@suse.de
|
||
|
||
- fix typo in apache-20-22-upgrade script: mod_image_map ->
|
||
mod_imagemap
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jun 12 11:28:59 CEST 2006 - poeml@suse.de
|
||
|
||
- enable logresolve processing of lines longer than 1024 characters
|
||
by compiling with MAXLINE=4096 [#162806]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 9 23:11:45 CEST 2006 - poeml@suse.de
|
||
|
||
- upstream 2.2.2
|
||
| SECURITY: CVE-2005-3357 (cve.mitre.org)
|
||
| mod_ssl: Fix a possible crash during access control checks
|
||
| if a non-SSL request is processed for an SSL vhost (such as
|
||
| the "HTTP request received on SSL port" error message when
|
||
| an 400 ErrorDocument is configured, or if using "SSLEngine
|
||
| optional"). PR 37791.
|
||
| SECURITY: CVE-2005-3352 (cve.mitre.org)
|
||
| mod_imagemap: Escape untrusted referer header before
|
||
| outputting in HTML to avoid potential cross-site scripting.
|
||
| Change also made to ap_escape_html so we escape quotes.
|
||
| Reported by JPCERT.
|
||
| mod_cache:
|
||
| - Make caching of reverse proxies possible again. PR 38017.
|
||
| mod_disk_cache:
|
||
| - Return the correct error codes from bucket read failures,
|
||
| instead of APR_EGENERAL.
|
||
| mod_dbd:
|
||
| - Update defaults, improve error reporting.
|
||
| - Create own pool and mutex to avoid problem use of process
|
||
| pool in request processing.
|
||
| mod_deflate:
|
||
| - work correctly in an internal redirect
|
||
| mod_proxy:
|
||
| - don't reuse a connection that may be to the wrong backend PR 39253
|
||
| - Do not release connections from connection pool twice. PR 38793.
|
||
| - Fix KeepAlives not being allowed and set to backend servers. PR 38602.
|
||
| - Fix incorrect usage of local and shared worker init. PR 38403.
|
||
| - If we get an error reading the upstream response, close the
|
||
| connection.
|
||
| mod_proxy_balancer:
|
||
| - Initialize members of a balancer correctly. PR 38227.
|
||
| mod_proxy_ajp:
|
||
| - Flushing of the output after each AJP chunk is now
|
||
| configurable at runtime via the 'flushpackets' and 'flushwait'
|
||
| worker params. Minor MMN bump.
|
||
| - Crosscheck the length of the body chunk with the length of the
|
||
| ajp message to prevent mod_proxy_ajp from reading beyond the
|
||
| buffer boundaries and thus revealing possibly sensitive memory
|
||
| contents to the client.
|
||
| - Support common headers of the AJP protocol in responses. PR 38340.
|
||
| mod_proxy_http:
|
||
| - Do send keep-alive header if the client sent connection:
|
||
| keep-alive and do not close backend connection if the client
|
||
| sent connection: close. PR 38524.
|
||
| mod_proxy_balancer:
|
||
| - Do not overwrite the status of initialized workers and respect
|
||
| the configured status of uninitilized workers when creating a
|
||
| new child process.
|
||
| - Fix off-by-one error in proxy_balancer. PR 37753.
|
||
| mod_speling:
|
||
| - Stop crashing with certain non-file requests.
|
||
| mod_ssl:
|
||
| - Fix possible crashes in shmcb with gcc 4 on platforms
|
||
| requiring word-aligned pointers. PR 38838.
|
||
| miscellaneous:
|
||
| - core: Prevent reading uninitialized memory while reading a line of
|
||
| protocol input. PR 39282.
|
||
| - core: Reject invalid Expect header immediately. PR 38123.
|
||
| - Default handler: Don't return output filter apr_status_t values.
|
||
| PR 31759.
|
||
| - Add APR/APR-Util Compiled and Runtime Version numbers to the
|
||
| output of 'httpd -V'.
|
||
| - http: If a connection is aborted while waiting for a chunked line,
|
||
| flag the connection as errored out.
|
||
| - Don't hang on error return from post_read_request. PR 37790.
|
||
| - Fix mis-shifted 32 bit scope, masked to 64 bits as a method.
|
||
| - Fix recursive ErrorDocument handling. PR 36090.
|
||
| - Ensure that the proper status line is written to the client, fixing
|
||
| incorrect status lines caused by filters which modify r->status without
|
||
| resetting r->status_line, such as the built-in byterange filter.
|
||
| - HTML-escape the Expect error message. Not classed as security as
|
||
| an attacker has no way to influence the Expect header a victim will
|
||
| send to a target site.
|
||
| - Chunk filter: Fix chunk filter to create correct chunks in the case that
|
||
| a flush bucket is surrounded by data buckets.
|
||
| - Avoid Server-driven negotiation when a script has emitted an
|
||
| explicit Status: header. PR 38070.
|
||
| - htdbm: Fix crash processing -d option in 64-bit mode on HP-UX.
|
||
| - htdbm: Warn the user when adding a plaintext password on a platform
|
||
| where it wouldn't work with the server (i.e., anywhere that has
|
||
| crypt()).
|
||
- adapted httpd-2.1.3alpha-autoconf-2.59.dif
|
||
- other user visible changes:
|
||
* use a2enmod, a2enflag in apache2-README.QUICKSTART.*
|
||
* add README.QUICKSTART link to httpd.conf
|
||
- when installing/updating, avoid irritating message in
|
||
/var/log/messages ("group is unknown - group=wwwadmin") [#183071]
|
||
- build system changes:
|
||
* clean up old cruft tight to suse_version macros
|
||
* don't run buildconf, and thus don't need python.
|
||
* don't ship uid.conf as source file, but create it dynamically
|
||
instead, according to user/group defined via rpm macro
|
||
* create wwwrun:www user on non-SUSE builds
|
||
* work around missimg macros insserv_prereq and fillup_prereq on non-SUSE builds
|
||
* add openssl-devel and expat-devel to Buildrequires for non-SUSE builds
|
||
* make sure that the rpm macro sles_version is defined
|
||
* remove obsolete VENDOR UnitedLinux macro
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Apr 25 18:10:28 CEST 2006 - poeml@suse.de
|
||
|
||
- obsolete 'apache' package on SLES10 (obsolete it on all platforms
|
||
except SLES9 and old SL releases)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Mar 29 11:54:00 CEST 2006 - poeml@suse.de
|
||
|
||
- remove php4 from default modules [#155333]
|
||
- fix comment in /etc/init.d/apache2 [#148559]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 20 13:49:07 CET 2006 - poeml@suse.de
|
||
|
||
- fixed comment in init script which indicated wrong version [#148559]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jan 30 12:41:20 CET 2006 - poeml@suse.de
|
||
|
||
- added Requires: libapr-util1-devel to apache2-devel package [#146496]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 27 15:10:15 CET 2006 - poeml@suse.de
|
||
|
||
- add a note about NameVirtualHost statements to the vhost template
|
||
files [#145000]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 25 21:34:16 CET 2006 - mls@suse.de
|
||
|
||
- converted neededforbuild to BuildRequires
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 20 13:20:04 CET 2006 - poeml@suse.de
|
||
|
||
- cleanup: remove obsolete metuxmpm patch
|
||
- improve informational text in apache-20-22-upgrade
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jan 18 10:11:12 CET 2006 - poeml@suse.de
|
||
|
||
- the new DYNAMIC_MODULE_LIMIT default in 2.2 is 128, so no need to
|
||
increase it anymore (fixes [#143536])
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 19 13:25:20 CET 2005 - poeml@suse.de
|
||
|
||
- update to 2.2.0
|
||
- enable all new modules
|
||
- replaced modules "auth auth_dbm access" in default configuration
|
||
by "auth_basic authn_file authn_dbm authz_host authz_default
|
||
authz_user""
|
||
- /usr/share/apache2/apache-20-22-upgrade will fix the module list
|
||
on upgrade
|
||
- fix bug in sysconf_addword (used by a2enmod) to respect word
|
||
boundaries when removing a word (but don't count slashes as word
|
||
boundary)
|
||
- remove perchild mpm subpackage, add experimemtal event mpm
|
||
- remove obsolete tool apache2-reconfigure-mpm
|
||
- remove obsolete perchild config from apache2-server-tuning.conf
|
||
- remove libapr0 subpackage; add libapr1 and libapr-util1 to #neededforbuild
|
||
- build against system pcre
|
||
- build with --enable-pie
|
||
- don't modify which libraries are linked in
|
||
- adjust IndexIgnore setting to upstream default. Previously, the
|
||
parent directory (..) was being ignored
|
||
- package the symlinks in ssl.crt
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 7 11:07:21 CET 2005 - poeml@suse.de
|
||
|
||
- patch apxs to use the new a2enmod tool, when called with -a
|
||
- add -l option to a2enmod, which gives a list of active modules
|
||
- adjust feedback address in the readmes
|
||
- update README.QUICKSTART.SSL (mention TinyCA)
|
||
- add more documentation in server-tuning.conf, and adjust defaults
|
||
- do not document the restart-hup action of the init script. It
|
||
should not be used
|
||
- don't install the tool checkgid -- it is only usable during
|
||
installation
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 18 13:22:21 CET 2005 - poeml@suse.de
|
||
|
||
- fix duplicated Source45 tag
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 24 14:17:08 CEST 2005 - poeml@suse.de
|
||
|
||
- update to 2.0.55. Relevant changes:
|
||
| SECURITY: CAN-2005-2700 (cve.mitre.org)
|
||
| mod_ssl: Fix a security issue where "SSLVerifyClient" was
|
||
| not enforced in per-location context if "SSLVerifyClient
|
||
| optional" was configured in the vhost configuration.
|
||
| SECURITY: CAN-2005-2491 (cve.mitre.org):
|
||
| Fix integer overflows in PCRE in quantifier parsing which
|
||
| could be triggered by a local user through use of a
|
||
| carefully-crafted regex in an .htaccess file.
|
||
| SECURITY: CAN-2005-2088 (cve.mitre.org)
|
||
| proxy: Correctly handle the Transfer-Encoding and
|
||
| Content-Length headers. Discard the request Content-Length
|
||
| whenever T-E: chunked is used, always passing one of either
|
||
| C-L or T-E: chunked whenever the request includes a request
|
||
| body. Resolves an entire class of proxy HTTP Request
|
||
| Splitting/Spoofing attacks.
|
||
| SECURITY: CAN-2005-2728 (cve.mitre.org)
|
||
| Fix cases where the byterange filter would buffer responses
|
||
| into memory. PR 29962.
|
||
| SECURITY: CAN-2005-2088 (cve.mitre.org)
|
||
| core: If a request contains both Transfer-Encoding and
|
||
| Content-Length headers, remove the Content-Length,
|
||
| mitigating some HTTP Request Splitting/Spoofing attacks.
|
||
| SECURITY: CAN-2005-1268 (cve.mitre.org)
|
||
| mod_ssl: Fix off-by-one overflow whilst printing CRL
|
||
| information at "LogLevel debug" which could be triggered if
|
||
| configured to use a "malicious" CRL. PR 35081.
|
||
| miscellaneous:
|
||
| - worker MPM: Fix a memory leak which can occur after an
|
||
| aborted connection in some limited circumstances.
|
||
| - worker mpm: don't take down the whole server for a transient
|
||
| thread creation failure. PR 34514
|
||
| - Added TraceEnable [on|off|extended] per-server directive to
|
||
| alter the behavior of the TRACE method. This addresses a
|
||
| flaw in proxy conformance to RFC 2616 - previously the proxy
|
||
| server would accept a TRACE request body although the RFC
|
||
| prohibited it. The default remains 'TraceEnable on'.
|
||
| - Add ap_log_cerror() for logging messages associated with
|
||
| particular client connections.
|
||
| - Support the suppress-error-charset setting, as with Apache
|
||
| 1.3.x. PR 31274.
|
||
| - Fix bad globbing comparison which could result in getting a
|
||
| directory listing when a file was requested. PR 34512.
|
||
| - Fix a file descriptor leak when starting piped loggers. PR
|
||
| 33748.
|
||
| - Prevent hangs of child processes when writing to piped
|
||
| loggers at the time of graceful restart. PR 26467.
|
||
| mod_cgid:
|
||
| - Correct mod_cgid's argv[0] so that the full path can be
|
||
| delved by the invoked cgi application, to conform to the
|
||
| behavior of mod_cgi.
|
||
| mod_include:
|
||
| - Fix possible environment variable corruption when using
|
||
| nested includes. PR 12655.
|
||
| mod_ldap:
|
||
| - Fix PR 36563. Keep track of the number of attributes
|
||
| retrieved from LDAP so that all of the values can be
|
||
| properly cached even if the value is NULL.
|
||
| - Fix core dump if mod_auth_ldap's
|
||
| mod_auth_ldap_auth_checker() was called even if
|
||
| mod_auth_ldap_check_user_id() was not (or if it didn't
|
||
| succeed) for non-authoritative cases.
|
||
| - Avoid segfaults when opening connections if using a version
|
||
| of OpenLDAP older than 2.2.21. PR 34618.
|
||
| - Fix various shared memory cache handling bugs. PR 34209.
|
||
| mod_proxy:
|
||
| - Fix over-eager handling of '%' for reverse proxies. PR
|
||
| 15207.
|
||
| - proxy HTTP: If a response contains both Transfer-Encoding
|
||
| and a Content-Length, remove the Content-Length and don't
|
||
| reuse the connection, mitigating some HTTP Response
|
||
| Splitting attacks.
|
||
| - proxy HTTP: Rework the handling of request bodies to handle
|
||
| chunked input and input filters which modify content length,
|
||
| and avoid spooling arbitrary-sized request bodies in memory.
|
||
| PR 15859.
|
||
| mod_ssl:
|
||
| - Fix build with OpenSSL 0.9.8. PR 35757.
|
||
| mod_rewrite:
|
||
| - use buffered I/O to improve performance with large
|
||
| RewriteMap txt: files.
|
||
| mod_userdir:
|
||
| - Fix possible memory corruption issue. PR 34588.
|
||
- drop obsolete patches httpd-2.0.54-openssl-0.9.8.dif
|
||
httpd-2.0.54-CAN-2005-1268-mod_ssl-crl.dif
|
||
apache2-bundled-pcre-5.0-CAN-2005-2491.dif
|
||
httpd-2.0.54-SSLVerifyClient-CAN-2005-2700.diff
|
||
httpd-2.0.54-ap_byterange-CAN-2005-2728.diff
|
||
- add httpd-2.0.55-37145_2.0.x.diff (broken mod_proxy in 2.0.55)
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 20 15:50:35 CEST 2005 - poeml@suse.de
|
||
|
||
- rc.apache2: when stopping the server, wait for the actual binary
|
||
of the parent process to disappear. Waiting for the pid file to
|
||
disappear is not sufficient, because not all cleanup might be
|
||
finished at the time of its removal. [#96492], [#85539]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Oct 12 15:42:47 CEST 2005 - poeml@suse.de
|
||
|
||
- fix security hole by wrongly initializing LD_LIBRARY_PATH in
|
||
/usr/sbin/envvars (used by apache2ctl only) [#118188]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 30 09:47:20 CEST 2005 - poeml@suse.de
|
||
|
||
- accomodate API changes to OpenSSL 0.9.8 (r209468 from 2.0.x branch)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 26 01:24:18 CEST 2005 - ro@suse.de
|
||
|
||
- define LDAP_DEPRECATED in CFLAGS
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 2 12:55:08 CEST 2005 - poeml@suse.de
|
||
|
||
- security fix [CAN-2005-2728 (cve.mitre.org)]:
|
||
fix memory consumption bug in byterange handling
|
||
- security fix [CAN-2005-2700 (cve.mitre.org)]: [#114701]
|
||
if "SSLVerifyClient optional" has been configured at the vhost
|
||
context then "SSLVerifyClient require" is not enforced in a
|
||
location context within that vhost; effectively allowing clients
|
||
to bypass client-cert authentication checks. [#114701]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 31 15:39:38 CEST 2005 - poeml@suse.de
|
||
|
||
- Security fix: fix integer overflows in PCRE in quantifier parsing which
|
||
could be triggered by a local user through use of a carefully-crafted
|
||
regex in an .htaccess file. CAN-2005-2491 [#112651] [#106209]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 30 17:41:46 CEST 2005 - lmuelle@suse.de
|
||
|
||
- Escape also any forward slash while removing a word with sysconf_addword.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 26 14:33:34 CEST 2005 - lmuelle@suse.de
|
||
|
||
- Escape any forward slash in the word argument of sysconf_addword.
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Aug 14 00:20:26 CEST 2005 - ro@suse.de
|
||
|
||
- alingn suexec2 permissions with permissions.secure
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 11 11:09:49 CEST 2005 - poeml@suse.de
|
||
|
||
- the permissions files are now maintained centrally and packaged
|
||
in the permissions package. Package suexec2 with mode 0750. [#66304]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 5 13:10:21 CEST 2005 - poeml@suse.de
|
||
|
||
- change SSLMutex "default" so APR always picks the best on the
|
||
platform
|
||
- fix Source42 tag which was present twice
|
||
- add a2enmod/a2enflag to add/remove modules/flags conveniently
|
||
- add charset.conv table for mod_auth_ldap
|
||
- make sure that suse_version is defined (it might be unset by e.g.
|
||
ISPs preinstallations)
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jul 12 23:49:29 CEST 2005 - poeml@suse.de
|
||
|
||
- security fix [CAN-2005-2088 (cve.mitre.org)]: core: If a request
|
||
contains both Transfer-Encoding and a Content-Length, remove the
|
||
Content-Length, stopping some HTTP Request smuggling attacks.
|
||
mod_proxy: Reject chunked requests. [#95709]
|
||
- security fix [CAN-2005-1268 (cve.mitre.org)]: mod_ssl: fix
|
||
off-by-one overflow whilst printing CRL information at "LogLevel
|
||
debug" which could be triggered if configured to use a
|
||
"malicious" CRL. PR 35081. [#95709]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jun 20 12:57:17 CEST 2005 - poeml@suse.de
|
||
|
||
- add httpd-2.0.47-pie.patch from from 2.1.3-dev to compile with
|
||
-fpie and link with -pie
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 18 16:46:22 CEST 2005 - poeml@suse.de
|
||
|
||
- update to 2.0.54. Relevant changes:
|
||
| mod_cache:
|
||
| - Add CacheIgnoreHeaders directive. PR 30399.
|
||
| mod_dav:
|
||
| - Correctly export all public functions.
|
||
| mod_ldap:
|
||
| - Added the directive LDAPConnectionTimeout to configure the
|
||
| ldap socket connection timeout value.
|
||
| mod_ssl:
|
||
| - If SSLUsername is used, set r->user earlier. PR 31418.
|
||
| miscellaneous:
|
||
| - Unix MPMs: Shut down the server more quickly when child
|
||
| processes are slow to exit.
|
||
| - worker MPM: Fix a problem which could cause httpd processes
|
||
| to remain active after shutdown.
|
||
| - Remove formatting characters from ap_log_error() calls.
|
||
| These were escaped as fallout from CAN-2003-0020.
|
||
| - core_input_filter: Move buckets to a persistent brigade
|
||
| instead of creating a new brigade. This stop a memory leak
|
||
| when proxying a Streaming Media Server. PR 33382.
|
||
| - htdigest: Fix permissions of created files. PR 33765.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 14 17:13:27 CET 2005 - poeml@suse.de
|
||
|
||
- revise README
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 7 17:14:16 CET 2005 - poeml@suse.de
|
||
|
||
- when building the suexec binary, set the "docroot" compile time
|
||
option to the datadir (/srv/www) instead of the htdocsdir
|
||
(/srv/www/htdocs), so it can be used with virtual hosts placed
|
||
e.g. in /srv/www/vhosts [#63845] Suggested by Winfried Kuiper.
|
||
- add php5 to APACHE_MODULES by default, so it can be used simply
|
||
by installing the package. Suppress warning about not-found
|
||
module in the php4/php5 case. [#66729]
|
||
- remove a redundant get_module_list call from the init script
|
||
- add hints about vhost setup to README.QUICKSTART
|
||
- after a change of APACHE_MPM, apache2-reconfigure-mpm is no
|
||
longer needed since SuSEconfig.apache2 is gone. Leave it for
|
||
compatibility, because /etc/sysconfig/apache2 is probably not
|
||
updated and yast may still use it.
|
||
- move the 4 most important variables in sysconfig.apache2 to the
|
||
top of the file
|
||
- add note about the old monolithic configuration file and how to
|
||
use it
|
||
- drop patch httpd-2.0.40-openssl-version.dif (we don't even have
|
||
openssl-0.9.6e anywhere, any longer)
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Mar 2 12:38:55 CET 2005 - poeml@suse.de
|
||
|
||
- fix TLS upgrade patch: with SSLEngine set to Optional, an
|
||
additional token in an Upgrade: header before "TLS/1.0" could
|
||
result into an infinite loop [#67126]
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 22 16:23:33 CET 2005 - poeml@suse.de
|
||
|
||
- run /usr/share/apache2/get_module_list post install, which will
|
||
also create the symlink to the httpd2 binary, which might be
|
||
necessary during package building when apache has been installed
|
||
but never been run.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 21 16:16:16 CET 2005 - poeml@suse.de
|
||
|
||
- remove SuSEconfig.apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 11 15:14:14 CET 2005 - poeml@suse.de
|
||
|
||
- raise DYNAMIC_MODULE_LIMIT to 80. The test suite loading all
|
||
available modules plus 9 perl modules was beginning to fail
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 9 11:46:37 CET 2005 - poeml@suse.de
|
||
|
||
- update to 2.0.53. Relevant changes:
|
||
| SECURITY: CAN-2004-0942 (cve.mitre.org)
|
||
| Fix for memory consumption DoS in handling of MIME folded request
|
||
| headers.
|
||
| SECURITY: CAN-2004-0885 (cve.mitre.org)
|
||
| mod_ssl: Fix a bug which allowed an SSLCipherSuite setting to be
|
||
| bypassed during an SSL renegotiation. PR 31505.
|
||
| mod_dumpio:
|
||
| - new I/O logging/dumping module, added to the
|
||
| modules/expermimental subdirectory.
|
||
| mod_ssl:
|
||
| - fail quickly if SSL connection is aborted rather than making
|
||
| many doomed ap_pass_brigade calls. PR 32699.
|
||
| - Fail at startup rather than segfault at runtime if a client cert
|
||
| is configured with an encrypted private key. PR 24030.
|
||
| mod_include:
|
||
| - Fix bug which could truncate variable expansions of N*64
|
||
| characters by one byte. PR 32985.
|
||
| mod_status:
|
||
| - Start keeping track of time-taken-to-process-request again if
|
||
| ExtendedStatus is enabled.
|
||
| util_ldap:
|
||
| - Util_ldap: Implemented the util_ldap_cache_getuserdn() API so
|
||
| that ldap authorization only modules have access to the
|
||
| util_ldap user cache without having to require ldap
|
||
| authentication as well. PR 31898.
|
||
| mod_ldap:
|
||
| - Fix format strings to use %APR_PID_T_FMT instead of %d.
|
||
| - prevent the possiblity of an infinite loop in the LDAP
|
||
| statistics display. PR 29216.
|
||
| - fix a bogus error message to tell the user which file is causing
|
||
| a potential problem with the LDAP shared memory cache. PR 31431
|
||
| - Fix the re-linking issue when purging elements from the LDAP
|
||
| cache PR 24801.
|
||
| mod_auth_ldap:
|
||
| - Added the directive "Requires ldap-attribute" that allows the
|
||
| module to only authorize a user if the attribute value specified
|
||
| matches the value of the user object. PR 31913
|
||
| - Handle the inconsistent way in which the MS LDAP library handles
|
||
| special characters. PR 24437.
|
||
| mod_proxy:
|
||
| - Fix ProxyRemoteMatch directive. PR 33170.
|
||
| - Respect errors reported by pre_connection hooks.
|
||
| - Handle client-aborted connections correctly. PR 32443.
|
||
| mod_cache:
|
||
| - CacheDisable will only disable the URLs it was meant to disable,
|
||
| not all caching. PR 31128.
|
||
| - Try to correctly follow RFC 2616 13.3 on validating stale cache
|
||
| responses.
|
||
| - Fix Expires handling.
|
||
| mod_disk_cache:
|
||
| - Do not store aborted content. PR 21492.
|
||
| - Correctly store cached content type. PR 30278.
|
||
| - Do not store hop-by-hop headers.
|
||
| - Fix races in saving responses.
|
||
| mod_expires:
|
||
| - Alter mod_expires to run at a different filter priority to allow
|
||
| proper Expires storage by mod_cache.
|
||
| mod_rewrite:
|
||
| - Handle per-location rules when r->filename is unset. Previously
|
||
| this would segfault or simply not match as expected, depending
|
||
| on the platform.
|
||
| - Fix 0 bytes write into random memory position. PR 31036.
|
||
| miscellaneous:
|
||
| - Fix --with-apr=/usr and/or --with-apr-util=/usr. PR 29740.
|
||
| - apxs: fix handling of -Wc/-Wl and "-o mod_foo.so". PR 31448
|
||
| - Allow for the use of --with-module=foo:bar where the ./modules/foo
|
||
| directory is local only. Assumes, of course, that the required
|
||
| files are in ./modules/foo, but makes it easier to statically
|
||
| build/log "external" modules.
|
||
| - --with-module can now take more than one module to be statically
|
||
| linked: --with-module=<modtype>:<modfile>,<modtype>:<modfile>,...
|
||
| If the <modtype>-subdirectory doesn't exist it will be created and
|
||
| populated with a standard Makefile.in.
|
||
| - Fix handling of files >2Gb on all platforms (or builds) where
|
||
| apr_off_t is larger than apr_size_t. PR 28898.
|
||
| - Remove compiled-in upper limit on LimitRequestFieldSize.
|
||
| - Correct handling of certain bucket types in ap_save_brigade, fixing
|
||
| possible segfaults in mod_cgi with #include virtual. PR 31247.
|
||
| - conf: Remove AddDefaultCharset from the default configuration
|
||
| because setting a site-wide default does more harm than good. PR
|
||
| 23421.
|
||
| - Add charset to example CGI scripts.
|
||
- merge tls-upgrade.patch
|
||
- remove obsolete httpd-2.0.47-headtail.dif
|
||
httpd-2.0.52-util_ldap_cache_mgr.c.dif
|
||
httpd-2.0.52-SSLCipherSuite-bypass-CAN-2004-0885.dif
|
||
httpd-2.0.52-ssl-incomplete-keypair.dif
|
||
httpd-2.0.52-memory-consumption-DoS-CAN-2004-0942.dif
|
||
httpd-2.0.52.21492.diff
|
||
httpd-2.0.52.30278.diff
|
||
httpd-2.0.52.30399.diff
|
||
httpd-2.0.52.30419.diff
|
||
httpd-2.0.52.31385.diff
|
||
- sync configuration with upstream changes
|
||
* Remove AddDefaultCharset (see upstream changelog above)
|
||
* LanguagePriority for error documents updated
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jan 15 20:46:53 CET 2005 - schwab@suse.de
|
||
|
||
- Use <owner>:<group> in permissions file.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 11 14:08:35 CET 2005 - schwab@suse.de
|
||
|
||
- Fix /etc/init.d/apache2 to use readlink instead of linkto or file.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 29 14:42:40 CET 2004 - hvogel@suse.de
|
||
|
||
- fix permission handling
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 11 13:06:22 CET 2004 - poeml@suse.de
|
||
|
||
- fix /etc/init.d/apache2 to correctly handle the start of multiple
|
||
instances of the same binary (using startproc -f plus prior check
|
||
for running instance) [#48153]
|
||
- fix helper scripts to allow overriding of $sysconfig_file and
|
||
other useful values
|
||
- remove unused 'rundir' variable from /etc/init.d/apache2
|
||
- removed backward compatibility code for pre-8.0
|
||
- add documentation to the vhost template files and
|
||
README.QUICKSTART
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 8 16:14:23 CET 2004 - poeml@suse.de
|
||
|
||
- security fix [CAN-2004-0942 (cve.mitre.org)]: Fix for memory
|
||
consumption DoS [#47967]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Nov 4 16:47:59 CET 2004 - poeml@suse.de
|
||
|
||
- remove heimdal-devel from #neededforbuild, it is not needed
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 15 07:44:20 CEST 2004 - poeml@suse.de
|
||
|
||
- fix SSLCipherSuite bypass CAN-2004-0885 (cve.mitre.org) [#47117]
|
||
- update the TLS upgrade patch [#47207]
|
||
- mod_ssl returned invalid method on TLS upgraded connections
|
||
- additional checks for httpd_method and default_port hooks
|
||
- fixed typo in upgrade header
|
||
- add patches from Ruediger Pluem for the experimental modules
|
||
mod_disk_cache, mod_cache
|
||
PR 21492: mod_disk_cache: Do not store aborted content.
|
||
PR 30278: mod_disk_cache: Correctly store cached content type.
|
||
PR 30399: make storing of Set-Cookie headers optional
|
||
PR 30419: weird caching behaviour of mod_cache and old Cookies
|
||
PR 31385: skipping start of file if recaching already cached file
|
||
- patch from 2.0.53: Fail to configure when an SSL proxy is
|
||
configured with incomplete client cert keypair, rather than
|
||
segfaulting at runtime. PR 24030
|
||
http://cvs.apache.org/viewcvs/httpd-2.0/modules/ssl/ssl_engine_init.c.diff?r1=1.118&r2=1.119
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 11 14:31:42 CEST 2004 - poeml@suse.de
|
||
|
||
- add patch fixing re-linking issue when purging elements from the
|
||
LDAP cache. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24801
|
||
http://www.apache.org/dist/httpd/patches/apply_to_2.0.52/util_ldap_cache_mgr.c.patch
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 11 14:07:33 CEST 2004 - poeml@suse.de
|
||
|
||
- sync update configuration with upstream changes (2.0.52)
|
||
(mostly comments; configuration for spanish manual added)
|
||
- add mime type for shortcut icons (favicon.ico)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Oct 8 18:36:21 CEST 2004 - poeml@suse.de
|
||
|
||
- update to 2.0.52. Relevant changes:
|
||
| SECURITY: CAN-2004-0811 (cve.mitre.org)
|
||
| Fix merging of the Satisfy directive, which was applied to
|
||
| the surrounding context and could allow access despite configured
|
||
| authentication. PR 31315.
|
||
| util_ldap:
|
||
| Fix a segfault in the LDAP cache when it is configured switched off.
|
||
| mod_mem_cache:
|
||
| Fixed race condition causing segfault because of memory being
|
||
| freed twice, or reused after being freed.
|
||
| mod_log_config:
|
||
| Fix a bug which prevented request completion time from being
|
||
| logged for I_INSIST_ON_EXTRA_CYCLES_FOR_CLF_COMPLIANCE
|
||
| processing. PR 29696.
|
||
| miscellaneous:
|
||
| - Use HTML 2.0 <hr> for error pages. PR 30732
|
||
| - Fix the handling of URIs containing %2F when
|
||
| AllowEncodedSlashes is enabled. Previously, such urls would
|
||
| still be rejected.
|
||
| - Fix the global mutex crash when the global mutex is never
|
||
| allocated due to disabled/empty caches.
|
||
| - Add -l option to rotatelogs to let it use local time rather
|
||
| than UTC. PR 24417.
|
||
- changes from 2.0.51:
|
||
| SECURITY: CAN-2004-0786 (cve.mitre.org)
|
||
| Fix an input validation issue in apr-util which could be
|
||
| triggered by malformed IPv6 literal addresses.
|
||
| SECURITY: CAN-2004-0747 (cve.mitre.org)
|
||
| Fix buffer overflow in expansion of environment variables in
|
||
| configuration file parsing.
|
||
| SECURITY: CAN-2004-0809 (cve.mitre.org)
|
||
| mod_dav_fs: Fix a segfault in the handling of an indirect lock
|
||
| refresh. PR 31183.
|
||
| SECURITY: CAN-2004-0751 (cve.mitre.org)
|
||
| mod_ssl: Fix a segfault in the SSL input filter which could be
|
||
| triggered if using "speculative" mode, for instance by a proxy
|
||
| request to an SSL server. PR 30134.
|
||
| SECURITY: CAN-2004-0748 (cve.mitre.org)
|
||
| mod_ssl: Fix a potential infinite loop. PR 29964.
|
||
| mod_include:
|
||
| no longer checks for recursion, because that's done in the core.
|
||
| This allows for careful usage of recursive SSI.
|
||
| mod_rewrite:
|
||
| - Fix memory leak in the cache handlingof mod_rewrite. PR 27862.
|
||
| - Add %{SSL:...} and %{HTTPS} variable lookups. PR 30464.
|
||
| - mod_rewrite now officially supports RewriteRules in <Proxy>
|
||
| sections. PR 27985.
|
||
| - no longer confuse the RewriteMap caches if different maps
|
||
| defined in different virtual hosts use the same map name. PR 26462.
|
||
| mod_ssl:
|
||
| - Add new 'ssl_is_https' optional function.
|
||
| - Add "SSLUserName" directive to set r->user based on a chosen SSL
|
||
| environment variable. PR 20957.
|
||
| - Avoid startup failure after unclean shutdown if using shmcb. PR 18989.
|
||
| mod_autoindex:
|
||
| - Don't truncate the directory listing if a stat() call fails (for
|
||
| instance on a >2Gb file). PR 17357.
|
||
| mod_cache, mod_disk_cache, mod_mem_cache:
|
||
| - Refactor cache modules, and switch to the provider API instead
|
||
| of hooks.
|
||
| mod_disk_cache:
|
||
| - Implement binary format for on-disk header files.
|
||
| - Optimize network performance of disk cache subsystem by allowing
|
||
| zero-copy (sendfile) writes and other miscellaneous fixes.
|
||
| mod_userdir:
|
||
| - Ensure that the userdir identity is used for suexec userdir
|
||
| access in a virtual host which has suexec configured. PR 18156.
|
||
| mod_setenvif:
|
||
| - Remove "support" for Remote_User variable which never worked at
|
||
| all. PR 25725.
|
||
| - Extend the SetEnvIf directive to capture subexpressions of the
|
||
| matched value.
|
||
| mod_headers:
|
||
| - Backport from 2.1 / Regression from 1.3: mod_headers now knows
|
||
| again the functionality of the ErrorHeader directive. But
|
||
| instead using this misnomer additional flags to the Header
|
||
| directive were introduced ("always" and "onsuccess", defaulting
|
||
| to the latter). PR 28657.
|
||
| mod_usertrack:
|
||
| - Escape the cookie name before pasting into the regexp.
|
||
| mod_dir:
|
||
| - the trailing-slash behaviour is now configurable using the
|
||
| DirectorySlash directive.
|
||
| util_ldap:
|
||
| - Switched the lock types on the shared memory cache from thread
|
||
| reader/writer locks to global mutexes in order to provide cross
|
||
| process cache protection.
|
||
| - Reworked the cache locking scheme to eliminate duplicate cache
|
||
| entries in the credentials cache due to race conditions.
|
||
| - Enhanced the util_ldap cache-info display to show more detail
|
||
| about the contents and current state of the cache.
|
||
| mod_ldap:
|
||
| - Enable the option to support anonymous shared memory in
|
||
| mod_ldap. This makes the cache work on Linux again.
|
||
| miscellaneous:
|
||
| - Include directives no longer refuse to process symlinks on
|
||
| directories. Instead there's now a maximum nesting level of
|
||
| included directories (128 as distributed). This is configurable
|
||
| at compile time using the -DAP_MAX_INCLUDE_DIR_DEPTH switch. PR
|
||
| 28492, PR 28370.
|
||
| - Prevent CGI script output which includes a Content-Range header
|
||
| from being passed through the byterange filter.
|
||
| - Satisfy directives now can be influenced by a surrounding
|
||
| <Limit> container. PR 14726.
|
||
| - Makefile fix: httpd is linked against LIBS given to the 'make'
|
||
| invocation. PR 7882.
|
||
| - suexec: Pass the SERVER_SIGNATURE envvar through to CGIs.
|
||
| - apachectl: Fix a problem finding envvars if sbindir != bindir.
|
||
| PR 30723.
|
||
| - Use the higher performing 'httpready' Accept Filter on all
|
||
| platforms except FreeBSD < 4.1.1.
|
||
| - Allow proxying of resources that are invoked via DirectoryIndex.
|
||
| PR 14648, 15112, 29961.
|
||
| - Small fix to allow reverse proxying to an ftp server. Previously
|
||
| an attempt to do this would try and connect to 0.0.0.0,
|
||
| regardless of the server specified. PR 24922
|
||
| - Enable special ErrorDocument value 'default' which restores the
|
||
| canned server response for the scope of the directive.
|
||
| - work around MSIE Digest auth bug - if
|
||
| AuthDigestEnableQueryStringHack is set in r->subprocess_env
|
||
| allow mismatched query strings to pass. PR 27758.
|
||
| - Accept URLs for the ServerAdmin directive. If the supplied
|
||
| argument is not recognized as an URL, assume it's a mail
|
||
| address. PR 28174.
|
||
| - initialize server arrays prior to calling
|
||
| ap_setup_prelinked_modules so that static modules can push
|
||
| Defines values when registering hooks just like DSO modules can
|
||
- drop obsolete security fixes
|
||
httpd-2.0.50-CAN-2004-0751-mod_ssl-proxied-request-segfault.dif
|
||
httpd-2.0.50-CAN-2004-0748-mod_ssl-input-filter-infinite-loop.dif
|
||
httpd-2.0.50-CAN-2004-0747-ENVVAR.dif
|
||
httpd-2.0.50-CAN-2004-0786-apr_uri_parse-IPv6-address-validation.dif
|
||
httpd-2.0.50-CAN-2004-0809-mod_dav-crash.dif
|
||
- httpd-2.0.45-anon-mmap.dif included upstream
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 14 12:11:58 CEST 2004 - poeml@suse.de
|
||
|
||
- security fix [CAN-2004-0809 (cve.mitre.org)]: fix possible DoS in
|
||
mod_dav by remotely triggerable null-pointer dereference
|
||
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183 [#45231]
|
||
- fix hint about vhost checking in the SSL readme
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Sep 8 14:24:19 CEST 2004 - poeml@suse.de
|
||
|
||
- security fix [CAN-2004-0786 (cve.mitre.org)]: fix a vulnerability
|
||
in the apr-util library (lacking input validation on IPv6 literal
|
||
addresses in the apr_uri_parse function [#44736]
|
||
- security fix [CAN-2004-0747 (cve.mitre.org)]: fix a buffer
|
||
overflow that can occur when expanding ${ENVVAR} constructs in
|
||
.htaccess or httpd.conf files. [#44736]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 6 12:48:21 CEST 2004 - poeml@suse.de
|
||
|
||
- rename check_forensic script to avoid clash with apache 1.3.x
|
||
package
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 27 16:18:41 CEST 2004 - poeml@suse.de
|
||
|
||
- implement action "startssl" in the init script. [#42365]
|
||
- add /usr/bin/check_forensic script to evaluate mod_log_forensic logs.
|
||
- disable building of leader and metuxmpm MPMs.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 25 12:58:20 CEST 2004 - poeml@suse.de
|
||
|
||
- security fix [CAN-2004-0748 (cve.mitre.org)]: fix a potential
|
||
infinite loop in the SSL input filter which can be triggered by
|
||
an aborted connection
|
||
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964 [#44103]
|
||
- security fix [CAN-2004-0751 (cve.mitre.org)]: fix a potential
|
||
segfault in the SSL input filter which can be triggered by the
|
||
response to request which is proxied to a remote SSL server
|
||
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134 [#44103]
|
||
- remove the obsolete notify message on package update
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jul 8 14:17:13 CEST 2004 - poeml@suse.de
|
||
|
||
- update to 2.0.50. Relevant changes:
|
||
| SECURITY: CAN-2004-0493 (cve.mitre.org)
|
||
| Close a denial of service vulnerability identified by Georgi
|
||
| Guninski which could lead to memory exhaustion with certain
|
||
| input data.
|
||
| SECURITY: CAN-2004-0488 (cve.mitre.org)
|
||
| mod_ssl: Fix a buffer overflow in the FakeBasicAuth code for
|
||
| a (trusted) client certificate subject DN which exceeds 6K in
|
||
| length.
|
||
| mod_alias:
|
||
| now emits a warning if it detects overlapping *Alias* directives.
|
||
| mod_cgi: Handle output on stderr during script execution on Unix
|
||
| platforms; preventing deadlock when stderr output fills pipe
|
||
| buffer. Also fixes case where stderr from nph- scripts could be
|
||
| lost. PR 22030, 18348.
|
||
| mod_dav:
|
||
| - Fix a problem that could cause crashes when manipulating locks
|
||
| on some platforms.
|
||
| mod_dav_fs:
|
||
| - Fix MKCOL response for missing parent collections, which caused
|
||
| issues for the Eclipse WebDAV extension. PR 29034.
|
||
| mod_deflate:
|
||
| - Fix memory consumption (which was proportional to the response
|
||
| size). PR 29318.
|
||
| mod_expires:
|
||
| - Fix segfault which occured under certain circumstances. PR 28047.
|
||
| mod_headers:
|
||
| - no longer crashes if an empty header value should be added.
|
||
| mod_log_forensic:
|
||
| - new module.
|
||
| mod_logio:
|
||
| - no longer removes the EOS bucket. PR 27928.
|
||
| mod_proxy:
|
||
| - Fix handling of IPv6 numeric strings.
|
||
| mod_rewrite:
|
||
| no longer turns forward proxy requests into reverse proxy
|
||
| requests. PR 28125
|
||
| mod_ssl:
|
||
| - Log the errors returned on failure to load or initialize a
|
||
| crypto accelerator engine.
|
||
| - Fix a potential segfault in the 'shmcb' session cache for small
|
||
| cache sizes. PR 27751.
|
||
| - Fix memory leak in session cache handling. PR 26562
|
||
| - Fix potential segfaults when performing SSL shutdown from a pool
|
||
| cleanup. PR 27945.
|
||
| mod_auth_ldap/util_ldap:
|
||
| - allow relative paths for LDAPTrustedCA to be resolved against
|
||
| ServerRoot PR#26602
|
||
| - Throw an error message if an attempt is made to use the
|
||
| LDAPTrustedCA or LDAPTrustedCAType directives in a VirtualHost.
|
||
| PR 26390
|
||
| - Fix a potential segfault if the bind password in the LDAP cache
|
||
| is NULL. PR 28250.
|
||
| - Overhaul handling of LDAP error conditions, so that the
|
||
| util_ldap_* functions leave the connections in a sane state
|
||
| after errors have occurred. PR 27748, 17274, 17599, 18661,
|
||
| 21787, 24595, 24683, 27134, 27271
|
||
| - mod_ldap calls ldap_simple_bind_s() to validate the user
|
||
| credentials. If the bind fails, the connection is left in an
|
||
| unbound state. Make sure that the ldap connection record is
|
||
| updated to show that the connection is no longer bound.
|
||
| - Update the bind credentials for the cached LDAP connection to
|
||
| reflect the last bind. This prevents util_ldap from creating
|
||
| unnecessary connections rather than reusing cached connections.
|
||
| - Quotes cannot be used around require group and require dn
|
||
| directives, update the documentation to reflect this. Also add
|
||
| quotes around the dn and group within debug messages, to make it
|
||
| more obvious why authentication is failing if quotes are used in
|
||
| error. PR 19304.
|
||
| miscellaneous:
|
||
| - Allow RequestHeader directives to be conditional. PR 27951.
|
||
| - Allow LimitRequestBody to be reset to unlimited. PR 29106
|
||
| - <VirtualHost myhost> now applies to all IP addresses for myhost
|
||
| instead of just the first one reported by the resolver. This
|
||
| corrects a regression since 1.3.
|
||
| - Fix a bunch of cases where the return code of the regex compiler
|
||
| was not checked properly. This affects: mod_setenvif,
|
||
| mod_usertrack, mod_proxy, mod_proxy_ftp and core. PR 28218.
|
||
| - Remove 2Gb log file size restriction on some 32-bit platforms.
|
||
| PR 13511.
|
||
| - htpasswd no longer refuses to process files that contain empty
|
||
| lines.
|
||
| - Regression from 1.3: At startup, suexec now will be checked for
|
||
| availability, the setuid bit and user root. The works only if
|
||
| httpd is compiled with the shipped APR version (0.9.5). PR
|
||
| 28287.
|
||
| - Unix MPMs: Stop dropping connections when the file descriptor is
|
||
| at least FD_SETSIZE.
|
||
| - Fix a segfault when requests for shared memory fails and returns
|
||
| NULL. Fix a segfault caused by a lack of bounds checking on the
|
||
| cache. PR 24801.
|
||
| - Ensure that lines in the request which are too long are properly
|
||
| terminated before logging.
|
||
| - htpasswd: use apr_temp_dir_get() and general cleanup
|
||
| - logresolve: Allow size of log line buffer to be overridden at
|
||
| build time (MAXLINE). PR 27793.
|
||
| - Fix the comment delimiter in htdbm so that it correctly parses
|
||
| the username comment. Also add a terminate function to allow
|
||
| NetWare to pause the output before the screen is destroyed.
|
||
| - Fix crash when Apache was started with no Listen directives.
|
||
| - core_output_filter: Fix bug that could result in sending garbage
|
||
| over the network when module handlers construct bucket brigades
|
||
| containing multiple file buckets all referencing the same open
|
||
| file descriptor.
|
||
| - Fix memory corruption problem with ap_custom_response()
|
||
| function. The core per-dir config would later point to request
|
||
| pool data that would be reused for different purposes on
|
||
| different requests.
|
||
- drop obsolete patches
|
||
- change vendor string SuSE -> SUSE
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 29 11:35:24 CEST 2004 - poeml@suse.de
|
||
|
||
- security fix [CAN-2004-0493 (cve.mitre.org)]: fix Denial of
|
||
Service vulnaribility which could lead to memory exhaustion with
|
||
certain input data. [#42566]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jun 18 11:39:53 CEST 2004 - poeml@suse.de
|
||
|
||
- package forgotten CHANGES file
|
||
- package apr and apr-util documentation files
|
||
- fix log_server_status2 to use perl's Socket module
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 19 13:38:41 CEST 2004 - poeml@suse.de
|
||
|
||
- security fix for mod_ssl: fix buffer overflow in
|
||
ssl_util_uuencode() [#40791]
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Apr 28 14:04:34 CEST 2004 - poeml@suse.de
|
||
|
||
- add TLS upgrade patch [#39449]
|
||
- add patch to allow writing log files larger than 2>GB [#39453]
|
||
- obsolete apache and mod_ssl versions only when older than what is
|
||
shipped with 9.1
|
||
- don't provide mod_ssl
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 2 15:56:30 CEST 2004 - cschum@suse.de
|
||
|
||
- Add "suse_help_viewer" provides [#37932]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 29 17:57:46 CEST 2004 - poeml@suse.de
|
||
|
||
- provide and obsolete packages apache, mod_ssl, apache-doc and
|
||
apache-example-pages [#37084]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 22 18:37:27 CET 2004 - poeml@suse.de
|
||
|
||
- disable large file support by not building with _FILE_OFFSET_BITS=64,
|
||
in favour of retaining a binary compatible module API.
|
||
Therefore, do not change the module magic number. LFS can be
|
||
enabled by building via rpmbuild --define 'build_with_LFS 1'
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 18 20:35:06 CET 2004 - poeml@suse.de
|
||
|
||
- update to proposed 2.0.49 tarball
|
||
- mod_cgid: Fix storage corruption caused by use of incorrect pool.
|
||
- docs update
|
||
- remove APACHE_DOCUMENT_ROOT from sysconfig.apache2 [#32635]
|
||
- fix a comment in default-server.conf
|
||
- remove obsolete ssl_scache_cleanup support script and ftok helper
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Mar 16 00:41:07 CET 2004 - poeml@suse.de
|
||
|
||
- change mmn in header file as well, for modules that include it
|
||
from there
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 15 17:36:07 CET 2004 - poeml@suse.de
|
||
|
||
- update to 2.0.49-rc2. Relevant changes:
|
||
| The whole codebase was relicensed and is now available under the
|
||
| Apache License, Version 2.0 (http://www.apache.org/licenses).
|
||
| [Apache Software Foundation]
|
||
| Security [CAN-2004-0113 (cve.mitre.org)]: mod_ssl: Fix a memory
|
||
| leak in plain-HTTP-on-SSL-port handling. PR 27106.
|
||
| Security [CAN-2003-0020 (cve.mitre.org)]: Escape arbitrary data
|
||
| before writing into the errorlog. Unescaped errorlogs are still
|
||
| possible using the compile time switch
|
||
| "-DAP_UNSAFE_ERROR_LOG_UNESCAPED".
|
||
| mod_ssl:
|
||
| - Send the Close Alert message to the peer before closing the
|
||
| SSL session. PR 27428.
|
||
| - Fix bug in passphrase handling which could cause spurious
|
||
| failures in SSL functions later. PR 21160.
|
||
| - Fix potential segfault on lookup of SSL_SESSION_ID. PR 15057.
|
||
| - Fix streaming output from an nph- CGI script. PR 21944
|
||
| - Advertise SSL library version as determined at run-time rather
|
||
| than at compile-time. PR 23956.
|
||
| - Fix segfault on a non-SSL request if the 'c' log format code
|
||
| is used. PR 22741.
|
||
| - Fix segfaults at startup if other modules which use OpenSSL
|
||
| are also loaded.
|
||
| - Use human-readable OpenSSL error strings in logs; use
|
||
| thread-safe interface for retrieving error strings.
|
||
| mod_cache:
|
||
| - Fixed cache-removal order in mod_mem_cache.
|
||
| - Fix segfault in mod_mem_cache cache_insert() due to cache size
|
||
| becoming negative. PR: 21285, 21287
|
||
| - Modified the cache code to be header-location agnostic. Also
|
||
| fixed a number of other cache code bugs related to PR 15852.
|
||
| Includes a patch submitted by Sushma Rai <rsushma novell.com>.
|
||
| This fixes mod_mem_cache but not mod_disk_cache yet so I'm not
|
||
| closing the PR since that is what they are using.
|
||
| mod_dav:
|
||
| - Reject requests which include an unescaped fragment in the
|
||
| Request-URI. PR 21779.
|
||
| - Use bucket brigades when reading PUT data. This avoids
|
||
| problems if the data stream is modified by an input filter. PR
|
||
| 22104.
|
||
| - Return a WWW-auth header for MOVE/COPY requests where the
|
||
| destination resource gives a 401. PR 15571.
|
||
| - Fix a problem with namespace mappings being dropped in
|
||
| mod_dav_fs; if any property values were set which defined
|
||
| namespaces these came out mangled in the PROPFIND response.
|
||
| PR 11637.
|
||
| mod_expires:
|
||
| - Initialize ExpiresDefault to NULL instead of "" to avoid
|
||
| reporting an Internal Server error if it is used without
|
||
| having been set in the httpd.conf file. PR: 23748, 24459
|
||
| - Add support for IMT minor-type wildcards (e.g., text/*) to
|
||
| ExpiresByType. PR#7991
|
||
| mod_log_config / logging:
|
||
| - Fix some piped log problems: bogus "piped log program '(null)'
|
||
| failed" messages during restart and problem with the logger
|
||
| respawning again after Apache is stopped. PR 21648, PR 24805.
|
||
| - mod_log_config: Fix corruption of buffered logs with threaded
|
||
| MPMs. PR 25520.
|
||
| - mod_log_config: Log the minutes component of the timezone correctly.
|
||
| PR 23642.
|
||
| mod_proxy*:
|
||
| - proxy_http fix: mod_proxy hangs when both KeepAlive and
|
||
| ProxyErrorOverride are enabled, and a non-200 response without a
|
||
| body is generated by the backend server. (e.g.: a client makes a
|
||
| request containing the "If-Modified-Since" and "If-None-Match"
|
||
| headers, to which the backend server respond with status 304.)
|
||
| - Fix memory leak in handling of request bodies during reverse
|
||
| proxy operations. PR 24991.
|
||
| - mod_proxy: Fix cases where an invalid status-line could be sent
|
||
| to the client. PR 23998.
|
||
| mod_rewrite:
|
||
| - Catch an edge case, where strange subsequent RewriteRules
|
||
| could lead to a 400 (Bad Request) response.
|
||
| - Make REMOTE_PORT variable available in mod_rewrite. PR 25772.
|
||
| - In external rewrite maps lookup keys containing
|
||
| a newline now cause a lookup failure. PR 14453.
|
||
| - Fix RewriteBase directive to not add double slashes.
|
||
| mod_usertrack:
|
||
| - Fix bug in mod_usertrack when no CookieName is set.
|
||
| - mod_usertrack no longer inspects the Cookie2 header for
|
||
| the cookie name. PR 11475.
|
||
| - mod_usertrack no longer overwrites other cookies.
|
||
| PR 26002.
|
||
| mod_include, filters:
|
||
| - Backport major overhaul of mod_include's filter parser from 2.1.
|
||
| The new parser code is expected to be more robust and should
|
||
| catch all of the edge cases that were not handled by the previous one.
|
||
| The 2.1 external API changes were hidden by a wrapper which is
|
||
| expected to keep the API backwards compatible.
|
||
| - Add a hook (insert_error_filter) to allow filters to re-insert
|
||
| themselves during processing of error responses. Enable mod_expires
|
||
| to use the new hook to include Expires headers in valid error
|
||
| responses. This addresses an RFC violation. It fixes PRs 19794,
|
||
| 24884, and 25123.
|
||
| - complain via error_log when mod_include's INCLUDES filter is
|
||
| enabled, but the relevant Options flag allowing the filter to run
|
||
| for the specific resource wasn't set, so that the filter won't
|
||
| silently get skipped. next remove itself, so the warning will be
|
||
| logged only once
|
||
| - Fix mod_include's expression parser to recognize strings correctly
|
||
| even if they start with an escaped token.
|
||
| - Fix a problem with the display of empty variables ("SetEnv foo") in
|
||
| mod_include. PR 24734
|
||
| - mod_include no longer allows an ETag header on 304 responses.
|
||
| PR 19355.
|
||
| mod_autoindex:
|
||
| - Don't omit the <tr> start tag if the SuppressIcon option is
|
||
| set. PR 21668.
|
||
| - Restore the ability to add a description for directories that
|
||
| don't contain an index file. (Broken in 2.0.48)
|
||
| - mod_autoindex / core: Don't fail to show filenames containing
|
||
| special characters like '%'. PR 13598.
|
||
| - Add 'XHTML' option in order to allow switching between HTML
|
||
| 3.2 and XHTML 1.0 output. PR 23747.
|
||
| mod_status:
|
||
| - Add mod_status hook to allow modules to add to the mod_status
|
||
| report.
|
||
| - Report total CPU time accurately when using a threaded MPM.
|
||
| PR 23795.
|
||
| mod_info:
|
||
| - Fix mod_info to use the real config file name, not the default
|
||
| config file name.
|
||
| - HTML escape configuration information so it displays
|
||
| correctly. PR 24232.
|
||
| mod_auth_digest:
|
||
| - Allow mod_auth_digest to work with sub-requests with different
|
||
| methods than the original request. PR 25040.
|
||
| mod_auth_ldap:
|
||
| - Fix some segfaults in the cache logic. PR 18756.
|
||
| mod_cgid:
|
||
| - Restart the cgid daemon if it crashes. PR 19849
|
||
| mod_setenvif:
|
||
| - Fix the regex optimizer, which under circumstances
|
||
| treated the supplied regex as literal string. PR 24219.
|
||
| miscellaneous:
|
||
| - core.c: If large file support is enabled, allow any file that is
|
||
| greater than AP_MAX_SENDFILE to be split into multiple buckets.
|
||
| This allows Apache to send files that are greater than 2gig.
|
||
| Otherwise we run into 32/64 bit type mismatches in the file size.
|
||
| - Fixed file extensions for real media files and removed rpm extension
|
||
| from mime.types. PR 26079.
|
||
| - Remove compile-time length limit on request strings. Length is
|
||
| now enforced solely with the LimitRequestLine config directive.
|
||
| - Set the scoreboard state to indicate logging prior to running
|
||
| logging hooks so that server-status will show 'L' for hung loggers
|
||
| instead of 'W'.
|
||
| - Fix the inability to log errors like exec failure in
|
||
| mod_ext_filter/mod_cgi script children. This was broken after
|
||
| such children stopped inheriting the error log handle.
|
||
| - fix "Expected </Foo>> but saw </Foo>" errors in nested,
|
||
| argumentless containers.
|
||
| - ap_mpm.h: Fix include guard of ap_mpm.h to reference mpm
|
||
| instead of mmn.
|
||
| - Add Polish translation of error messages. PR 25101.
|
||
| - Add AP_MPMQ_MPM_STATE function code for ap_mpm_query.
|
||
| - Fix htdbm to generate comment fields in DBM files correctly.
|
||
| - Correct UseCanonicalName Off to properly check incoming port number.
|
||
| - Fix slow graceful restarts with prefork MPM.
|
||
| - Keep focus of ITERATE and ITERATE2 on the current module when
|
||
| the module chooses to return DECLINE_CMD for the directive.
|
||
| PR 22299.
|
||
| - Build array of allowed methods with proper dimensions, fixing
|
||
| possible memory corruption.
|
||
| - worker MPM: fix stack overlay bug that could cause the parent
|
||
| process to crash.
|
||
| - Add XHTML Document Type Definitions to httpd.h (minor MMN bump).
|
||
| - Fix build with parallel make. PR 24643.
|
||
| - Add fatal exception hook for use by diagnostic modules. The hook
|
||
| is only available if the --enable-exception-hook configure parm
|
||
| is used and the EnableExceptionHook directive has been set to
|
||
| "on".
|
||
| - Improve 'configure --help' output for some modules.
|
||
- drop two hunks from httpd-2.0.47-headtail.dif (buildcheck.sh is
|
||
fixed)
|
||
- disable automatic restarts, because they do not work properly
|
||
[#35408]
|
||
- change MMN to prevent loading of incompatible modules (modules
|
||
that are not built with `apxs -q CFLAGS` and therefore miss
|
||
_FILE_OFFSET_BITS=64). Provide our old apache_mmn_20020903 in
|
||
addition.
|
||
- use CPPFLAGS for passing preprocessor flags because they are
|
||
removed from CFLAGS
|
||
- Stop dropping connections when the file descriptor
|
||
is at least FD_SETSIZE. This isn't a problem on Linux because
|
||
poll() is used instead of select() by APR. Assert HAVE_POLL.
|
||
[#34178]
|
||
- add modifications to the code to the NOTICE file as required by
|
||
the new license
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 27 17:42:24 CET 2004 - poeml@suse.de
|
||
|
||
- compile with -DSSL_EXPERIMENTAL_ENGINE to allow usage of hardware
|
||
crypto accelerators
|
||
- compile with -DMAX_SERVER_LIMIT=200000
|
||
- if an SSL passphrase is not entered within the timeout, fall back
|
||
to start apache without SSL (with -D NOSSL). This could/should be
|
||
made configurable.
|
||
- clean up output of SuSEconfig.apache2
|
||
- add pre-defined LogFormat "vhost_combined"
|
||
- configure /var/lib/apache2 for WebDAV locks
|
||
- add a readme about configuring WebDAV with digest authentication
|
||
- add default configuration for mod_usertrack (this is the current
|
||
workaround for the problem in the 1.3.29/2.0.48 release that
|
||
occurs if no CookieName is configured)
|
||
- in vhost.template, enclose all virtual host configuration in the
|
||
VirtualHost container
|
||
- update metuxmpm patch to r7
|
||
- fix test run as non-root
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 13 16:38:05 CET 2004 - schwab@suse.de
|
||
|
||
- Fix quoting in autoconf macros.
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 13 17:28:48 CET 2003 - poeml@suse.de
|
||
|
||
- add changes to gensslcert from Volker Kuhlmann [#31803]
|
||
- revert default character set from UTF-8 to ISO-8859-1, and revert
|
||
the misleading comment that talked about filenames while it is
|
||
all about content of the files
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Nov 18 14:14:39 CET 2003 - poeml@suse.de
|
||
|
||
- add a ServerLimit directive to server-tuning.conf, so it's
|
||
already in the right place if someone needs to tweak it [#32852]
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Nov 7 13:00:07 CET 2003 - poeml@suse.de
|
||
|
||
- mark apache2-manual.conf in %files doc as %config
|
||
- wrap directives specific to the mod_negotiation module into an
|
||
<IfModule> block [#32848]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 30 11:41:19 CET 2003 - poeml@suse.de
|
||
|
||
- update to 2.0.48. Relevant / user visible changes are:
|
||
Security [CAN-2003-0789]: Resolve some mishandling of the AF_UNIX
|
||
socket used to communicate with the cgid daemon and the CGI
|
||
script.
|
||
Security [CAN-2003-0542]: Fix buffer overflows in mod_alias and
|
||
mod_rewrite which occurred if one configured a regular
|
||
expression with more than 9 captures.
|
||
mod_rewrite:
|
||
- Don't die silently when failing to open RewriteLogs. PR 23416
|
||
- Fix support of the [P] option to send rewritten request using
|
||
"proxy:". The code was adding multiple "proxy:" fields in the
|
||
rewritten URI. PR: 13946.
|
||
- Ignore RewriteRules in .htaccess files if the directory
|
||
containing the .htaccess file is requested without a trailing
|
||
slash. PR 20195.
|
||
mod_include:
|
||
- Fix a trio of bugs that would cause various unusual sequences
|
||
of parsed bytes to omit portions of the output stream. PR 21095
|
||
- fix segfault which occured if the filename was not set, for
|
||
example, when processing some error conditions.
|
||
mod_cgid: fix a hash table corruption problem which could
|
||
result in the wrong script being cleaned up at the end of a
|
||
request.
|
||
mod_ssl: Fix segfaults after renegotiation failure. PR 21370
|
||
- Fix a problem setting variables that represent the client
|
||
certificate chain. PR 21371
|
||
- Fix FakeBasicAuth for subrequest. Log an error when an
|
||
identity spoof is encountered.
|
||
- Assure that we block properly when reading input bodies with
|
||
SSL. PR 19242.
|
||
mod_autoindex: If a directory contains a file listed in the
|
||
DirectoryIndex directive, the folder icon is no longer replaced
|
||
by the icon of that file. PR 9587.
|
||
mod_usertrack: do not get false positive matches on the
|
||
user-tracking cookie's name. PR 16661.
|
||
mod_cache:
|
||
- Fix the cache code so that responses can be cached if they
|
||
have an Expires header but no Etag or Last-Modified headers.
|
||
PR 23130. cache_util: Fix ap_check_cache_freshness to check
|
||
max_age, smax_age, and expires as directed in RFC 2616.
|
||
mod_deflate:
|
||
- fix to not call deflate() without checking first whether it
|
||
has something to deflate. (Currently this causes deflate to
|
||
generate a fatal error according to the zlib spec.) PR 22259.
|
||
- Don't attempt to hold all of the response until we're done.
|
||
- Fix a bug, where mod_deflate sometimes unconditionally
|
||
compressed the content if the Accept-Encoding header
|
||
contained only other tokens than "gzip" (such as "deflate").
|
||
PR 21523.
|
||
mod_proxy: Don't respect the Server header field as set by
|
||
modules and CGIs. As with 1.3, for proxy requests any such
|
||
field is from the origin server; otherwise it will have our
|
||
server info as controlled by the ServerTokens directive.
|
||
mod_log_config: Fix %b log format to write really "-" when 0
|
||
bytes were sent (e.g. with 304 or 204 response codes).
|
||
mod_ext_filter: Set additional environment variables for use by
|
||
the external filter. PR 20944.
|
||
core:
|
||
- allow <Foo>..</Foo> containers (no arguments in the opening
|
||
tag), as in 1.3. Needed by mod_perl <Perl> sections
|
||
- Fix a misleading message from the some of the threaded MPMs
|
||
when MaxClients has to be lowered due to the setting of
|
||
ServerLimit.
|
||
- Avoid an infinite recursion, which occured if the name of an
|
||
included config file or directory contained a wildcard
|
||
character. PR 22194.
|
||
- MPMs: The bucket brigades subsystem now honors the MaxMemFree
|
||
setting.
|
||
- Lower the severity of the "listener thread didn't exit"
|
||
message to debug, as it is of interest only to developers.
|
||
miscellaneous:
|
||
- Update the header token parsing code to allow LWS between the
|
||
token word and the ':' seperator. [PR 16520]
|
||
- Remember an authenticated user during internal redirects if
|
||
the redirection target is not access protected and pass it to
|
||
scripts using the REDIRECT_REMOTE_USER environment variable.
|
||
PR 10678, 11602.
|
||
- Update mime.types to include latest IANA and W3C types.
|
||
- Modify ap_get_client_block() to note if it has seen EOS.
|
||
ab:
|
||
- Overlong credentials given via command line no longer clobber
|
||
the buffer.
|
||
- Work over non-loopback on Unix again. PR 21495.
|
||
- Fix NULL-pointer issue in ab when parsing an incomplete or
|
||
non-HTTP response. PR 21085.
|
||
- add another example to apache2-listen.conf
|
||
- update apache2-mod_mime-defaults.conf according to 2.0.48 changes
|
||
(be clearer in describing the connection between AddType and
|
||
AddEncoding for defining the meaning of compressed file
|
||
extensions.)
|
||
- use a better example domain name in apache2-vhost-ssl.template
|
||
- the "define version_perl" was nowhere needed
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 22 17:49:40 CEST 2003 - mls@suse.de
|
||
|
||
- don't provide httpddoc in apache2-doc
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Sep 18 18:48:33 CEST 2003 - poeml@suse.de
|
||
|
||
- add mod_php4 to the default list of APACHE_MODULES, and change
|
||
get_module_list to ignore non-existant modules (warnings will
|
||
be issued when it is run from SuSEconfig, but not from the init
|
||
script). How to enable the PHP4 module has been the most
|
||
frequently asked questions in user feedback [cf to #29735].
|
||
This bug is tracked in [#31306]
|
||
- include conf.d/*.conf by default, as it was the case until
|
||
recently. User feedback showed that for many people the
|
||
separation of configuration includes into individual virtual
|
||
hosts is overkill, and it complicates the setup too much. More
|
||
finegrained control can be achieved by commenting out the
|
||
respective line in the default server config. [#30866], [#29735]
|
||
- remove the FIXME at the end of httpd.conf (obsoleted by the above
|
||
change), and place a strategical comment there about .local files
|
||
- add <IfDefine SSL> container around configuration in ssl template
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 9 12:50:47 CEST 2003 - poeml@suse.de
|
||
|
||
- change comment in sysconfig template to work around a fillup bug
|
||
[#30279]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 8 18:28:12 CEST 2003 - poeml@suse.de
|
||
|
||
- fix wrong variable name in a comment of the sysconfig template
|
||
- update README.QUICKSTART
|
||
- add README.QUICKSTART.SSL
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 8 10:09:53 CEST 2003 - poeml@suse.de
|
||
|
||
- remove unused ENABLE_SUSECONFIG_APACHE from sysconfig template
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 5 16:44:07 CEST 2003 - poeml@suse.de
|
||
|
||
- disallow UserDir for user root
|
||
- cope with "no" or "yes" as values for APACHE_SERVERSIGNATURE, as
|
||
they were set on SuSE Linux 8.1
|
||
- add more documentation to README.QUICKSTART, also mentioning what
|
||
might be too obvious: the document root [#29674]
|
||
- in %post, diff to httpd.conf.default only when .rpmnew is present
|
||
- improve message sent on update
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 29 23:22:31 CEST 2003 - poeml@suse.de
|
||
|
||
- improve documentation on configuration
|
||
- compile with -Wall
|
||
- do not obsolete httpddoc, which is provided by apache-doc package
|
||
from apache1
|
||
- add conflict apache2-example-pages <-> apache-example-pages
|
||
- fix building on older distros
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Aug 19 02:19:18 CEST 2003 - poeml@suse.de
|
||
|
||
- use httpd-2.0.47-metuxmpm-r6.diff, previous one was broken by me
|
||
- don't force setting of a DocumentRoot, because the configuration
|
||
of the default vhost already contains it
|
||
- when testing on SL 8.0, the www group has to be created as well
|
||
- when testing on even older systems, don't add buildroot to
|
||
DocumentRoot in default-server.conf
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 15 21:40:46 CEST 2003 - poeml@suse.de
|
||
|
||
- revamped configuration
|
||
- add some CustomLog formats
|
||
- AddDefaultCharset UTF-8 [#22427]
|
||
- add activation metadata to sysconfig template [#28834]
|
||
- default APACHE_MODULES: add mod_ssl, remove mod_status
|
||
- new sysconfig variables: APACHE_USE_CANONICAL_NAME,
|
||
APACHE_DOCUMENT_ROOT
|
||
- get rid of the "suse_" prefix in generated config snippets, and
|
||
place them below /etc/apache2/sysconfig.d/. On update, convert
|
||
the Include statements in httpd.conf for the new locations
|
||
- add /etc/apache2/vhosts.d and virtual host templates
|
||
- the configuration for the manual is now seperate and installed
|
||
together with apache2-doc (conf.d/apache2-manual.conf)
|
||
- add distilled wisdom in form of README.QUICKSTART
|
||
- change group of wwwrun user: nogroup -> www [#21782]
|
||
- proxycachedir and localstatedir should not be world readable
|
||
- set DEFAULT_PIDLOG to /var/run/httpd2.pid, so we don't need to
|
||
configure the PidFile directive
|
||
- add -fno-strict-aliasing, due to warnings about code where
|
||
dereferencing type-punned pointers will break strict aliasing
|
||
- clean the RPM_BUILD_ROOT, but not in the build system
|
||
- new macros for stop/restart of services on rpm update/removal,
|
||
and improved try-restart section in rc.apache2
|
||
- get rid of "modules" subdir, and remove dead code from
|
||
SuSEconfig.apache2
|
||
- add some tools: get_includes, find_httpd2_includes,
|
||
apache2-reconfigure-mpm
|
||
- rename README.SuSE to README.{SuSE,UnitedLinux}
|
||
- include directories in filelists of MPM subpackages
|
||
- enclose package descriptions of MPMs in %ifdef
|
||
- add a dependency of the MPM subpackages on the version of the
|
||
main package
|
||
- build a new MPM: metuxmpm (httpd-2.0.47-metuxmpm.diff)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Jul 28 18:23:28 CEST 2003 - poeml@suse.de
|
||
|
||
- add new sysconfig variables: APACHE_LOGLEVEL, APACHE_ACCESS_LOG,
|
||
and remove the respective directives from httpd.conf.dist
|
||
- merge the ssl.conf.dif and httpd.conf.dif into one patch
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jul 27 12:22:29 CEST 2003 - poeml@suse.de
|
||
|
||
- build with -D_FILE_OFFSET_BITS=64 when presumably the kernel
|
||
supports sendfile64 [#22191, #22018]. Define APR_HAS_LARGE_FILES
|
||
(which is unconditionally off, otherwise). Keep
|
||
-D_LARGEFILE_SOURCE since some modules might need it.
|
||
- make sure the package can be built as ordinary user
|
||
- special case mod_auth_mysql since its module_id is reversed
|
||
- don't increase DYNAMIC_MODULE_LIMIT (64 should be copious)
|
||
- don't explicitely strip binaries since RPM handles it, and may
|
||
keep the stripped information somewhere
|
||
- reformat the header of the spec file
|
||
- allow to pass a number-of-jobs parameter into spec file via rpm
|
||
--define 'jobs N'
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jul 10 16:49:50 CEST 2003 - poeml@suse.de
|
||
|
||
- update to 2.0.47. relevant / user visible changes:
|
||
Security [CAN-2003-0192]: Fixed a bug whereby certain sequences
|
||
of per-directory renegotiations and the SSLCipherSuite
|
||
directive being used to upgrade from a weak ciphersuite to a
|
||
strong one could result in the weak ciphersuite being used in
|
||
place of the strong one.
|
||
Security [CAN-2003-0253]: Fixed a bug in prefork MPM causing
|
||
temporary denial of service when accept() on a rarely accessed
|
||
port returns certain errors.
|
||
Security [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
|
||
of service when target host is IPv6 but proxy server can't
|
||
create IPv6 socket. Fixed by the reporter.
|
||
Security [VU#379828]: Prevent the server from crashing when entering
|
||
infinite loops. The new LimitInternalRecursion directive
|
||
configures limits of subsequent internal redirects and nested
|
||
subrequests, after which the request will be aborted. PR 19753+
|
||
core:
|
||
core_output_filter: don't split the brigade after a FLUSH
|
||
bucket if it's the last bucket. This prevents creating
|
||
unneccessary empty brigades which may not be destroyed until
|
||
the end of a keepalive connection.
|
||
mod_cgid:
|
||
Eliminate a double-close of a socket. This resolves various
|
||
operational problems in a threaded MPM, since on the second
|
||
attempt to close the socket, the same descriptor was often
|
||
already in use by another thread for another purpose.
|
||
mod_negotiation:
|
||
Introduce "prefer-language" environment variable, which allows
|
||
to influence the negotiation process on request basis to prefer
|
||
a certain language.
|
||
mod_expire:
|
||
Make ExpiresByType directive work properly, including for
|
||
dynamically-generated documents.
|
||
- apr bugfixes
|
||
- more fixes of deprecated head/tail -1 calls
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 28 20:40:24 CEST 2003 - poeml@suse.de
|
||
|
||
- update to 2.0.46. relevant / user visible changes:
|
||
Security [CAN-2003-0245]: Fixed a bug that could be triggered
|
||
remotely through mod_dav
|
||
Security [CAN-2003-0189]: Fixed a denial-of-service
|
||
vulnerability affecting basic authentication
|
||
Security: forward port of buffer overflow fixes for htdigest.
|
||
mod_ssl:
|
||
- SSL session caching(shmht) : Fix a SEGV problem with SHMHT
|
||
session caching.
|
||
mod_deflate:
|
||
- Add another check for already compressed content
|
||
- Check also err_headers_out for an already set
|
||
Content-Encoding: gzip header. This prevents gzip compressed
|
||
content from a CGI script from being compressed once more.
|
||
mod_mime_magic:
|
||
- If mod_mime_magic does not know the content-type, do not
|
||
attempt to guess.
|
||
mod_rewrite:
|
||
- Fix handling of absolute URIs.
|
||
mod_log_config:
|
||
- Add the ability to log the id of the thread processing the
|
||
request via new %P formats.
|
||
mod_auth_ldap:
|
||
- Use generic whitespace character class when parsing "require"
|
||
directives, instead of literal spaces only.
|
||
mod_proxy:
|
||
- Fixed a segfault when multiple ProxyBlock directives were used.
|
||
- Added AllowEncodedSlashes directive to permit control of
|
||
whether the server will accept encoded slashes ('%2f') in the
|
||
URI path. Default condition is off (the historical behaviour).
|
||
- If Apache is started as root and you code CoreDumpDirectory,
|
||
coredumps are enabled via the prctl() syscall.
|
||
- htpasswd: Check the processed file on validity; add a delete flag.
|
||
- httpd-2.0.45-libtool-1.5.dif is obsolete
|
||
- mark suse_include.conf as %ghost
|
||
- note the rebirth of the httpd and apachectl man pages (thanks to
|
||
RPMv4 :)
|
||
- let the module RPM packages only depend on the _major_ module
|
||
magic number, not on the minor
|
||
- fix some paths in config_vars.mk, which facilitates building of
|
||
certain modules
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 14 14:12:56 CEST 2003 - poeml@suse.de
|
||
|
||
- use mmap() via MAP_ANON as shared memory allocation method, to
|
||
prevent restart problems with stale (or in use) files that are
|
||
associated with shared memory
|
||
- package forgotten files, and remove hack in %clean
|
||
- remove files from the build root that are not packaged
|
||
- remove suse_include.conf from filelist
|
||
|
||
-------------------------------------------------------------------
|
||
Fri May 9 14:47:54 CEST 2003 - poeml@suse.de
|
||
|
||
- update to 2.0.45. relevant / user visible changes:
|
||
Security: Eliminated leaks of several file descriptors to
|
||
child processes, such as CGI scripts. This fix depends on the
|
||
latest APR library release 0.9.2, which is distributed with the
|
||
httpd source tarball for Apache 2.0.45. PR 17206
|
||
Security [CAN-2003-0132]: Close a Denial of Service
|
||
vulnerability identified by David Endler <DEndler@iDefense.com>
|
||
on all platforms.
|
||
General:
|
||
- Fix segfault which occurred when a section in an included
|
||
configuration file was not closed. PR 17093.
|
||
- Fix a nasty segfault in mmap_bucket_setaside() caused by
|
||
passing an incompatible pointer type to mmap_bucket_destroy(void*).
|
||
- prevent filters (such as mod_deflate) from adding garbage to
|
||
the response. PR 14451.
|
||
- Simpler, faster code path for request header scanning
|
||
- Try to log an error if a piped log program fails. Try to
|
||
restart a piped log program in more failure situations.
|
||
- Fix bug where 'Satisfy Any' without an AuthType lost all MIME
|
||
information (and more). Related to PR 9076.
|
||
- Fix If header parsing when a non-mod_dav lock token is passed to it.
|
||
- Fix apxs to insert LoadModule directives only outside of
|
||
sections.
|
||
- apxs: Include any special APR ld flags when linking the DSO.
|
||
suexec: Be more pedantic when cleaning environment. Clean it
|
||
immediately after startup. PR 2790, 10449. Use saner default
|
||
config values for suexec. PR 15713.
|
||
mod_cgi, mod_cgid, mod_ext_filter: Log errors when scripts cannot
|
||
be started on Unix because of such problems as bad permissions,
|
||
bad shebang line, etc. Fix possible segfaults under obscure
|
||
error conditions within the cgid daemon.
|
||
mod_deflate:
|
||
- you can now specify the compression level.
|
||
- Extend the DeflateFilterNote directive to allow accurate
|
||
logging of the filter's in- and outstream.
|
||
- Fix potential memory leaks in mod_deflate on malformed data. PR 16046.
|
||
mod_ssl:
|
||
Allow SSLMutex to select/use the full range of APR locking
|
||
mechanisms available to it. Also, fix the bug that SSLMutex
|
||
uses APR_LOCK_DEFAULT no matter what. PR 8122
|
||
mod_autoindex no longer forgets output format and enabled version
|
||
sort in linked column headers.
|
||
mod_rewrite:
|
||
- Prevent endless loops of internal redirects in mod_rewrite by
|
||
aborting after exceeding a limit of internal redirects. The
|
||
limit defaults to 10 and can be changed using the
|
||
RewriteOptions directive. PR 17462.
|
||
- Allow "RewriteEngine Off" even if no "Options FollowSymlinks"
|
||
(or SymlinksIfOwnermatch) is set. PR 12395.
|
||
mod_ldap:
|
||
- Updated mod_ldap and mod_auth_ldap to support the Novell LDAP
|
||
SDK SSL and standardized the LDAP SSL support across the
|
||
various LDAP SDKs. Isolated the SSL functionality to
|
||
mod_ldap rather than speading it across mod_auth_ldap and
|
||
mod_ldap. Also added LDAPTrustedCA and LDAPTrustedCAType
|
||
directives to mod_ldap to allow for a more common method of
|
||
specifying the SSL certificate.
|
||
- fix fault when caching was disabled, and some memory leaks
|
||
- Fix mod_ldap to open an existing shared memory file should
|
||
one already exist. PR 12757.
|
||
- Added character set support to mod_auth_LDAP to allow it to
|
||
convert extended characters used in the user ID to UTF-8
|
||
before authenticating against the LDAP directory. The new
|
||
directive AuthLDAPCharsetConfig is used to specify the config
|
||
file that contains the character set conversion table.
|
||
mod_ssl:
|
||
- Fixed mod_ssl's SSLCertificateChain initialization to no
|
||
longer skip the first cert of the chain by default. This
|
||
misbehavior was introduced in 2.0.34. PR 14560
|
||
- Fix 64-bit problem in mod_ssl input logic.
|
||
mod_proxy:
|
||
- Hook mod_proxy's fixup before mod_rewrite's fixup, so that by
|
||
mod_rewrite proxied URLs will not be escaped accidentally by
|
||
mod_proxy's fixup. PR 16368
|
||
- Don't remove the Content-Length from responses in mod_proxy PR: 8677
|
||
mod_auth_digest no longer tries to guess AuthDigestDomain, if it's
|
||
not specified. Now it assumes "/" as already documented. PR 16937.
|
||
mod_file_cache: fix segfaults
|
||
- improve the start/restart section of the init script, and add a
|
||
ssl_scache_cleanup script
|
||
- understand a syntax like -DSTATUS, as described in the sysconfig
|
||
file help text (bug noted in #25404]
|
||
- don't package the *.exp files, as they are needed only on AIX
|
||
- fix filelist for usage of %dir for files
|
||
- fix the cosmetical but irritating "Inappropriate ioctl for
|
||
device" error message, when rcapache2 is called from within YaST
|
||
- remove the unused /etc/apache2/modules directory from the package
|
||
- remove the now unused --enable-experimental-libtool
|
||
- fix to build with libtool-1.5
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Apr 9 02:00:20 CEST 2003 - ro@suse.de
|
||
|
||
- fix deprecated head/tail call syntax "-1"
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 17 11:59:36 CET 2003 - kukuk@suse.de
|
||
|
||
- Remove suse_help_viewer from provides [Bug #25436]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Mar 13 12:54:59 CET 2003 - poeml@suse.de
|
||
|
||
- security fix: do not write the startup log file to a world
|
||
writable directory, reversing the change of Jan 23 (wasn't in any
|
||
released package) [#25239]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 10 17:36:00 CET 2003 - poeml@suse.de
|
||
|
||
- change permissions of /var/log/apache2 from wwwrun:root mode 770
|
||
to root:root mode 750 [#24951]
|
||
- fix wrong list() in sysconfig.apache2 [#24719], and add a missing
|
||
default value
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Mar 3 17:41:56 CET 2003 - kukuk@suse.de
|
||
|
||
- Remove ghost entry for pid file [Bug #24566]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 27 14:43:01 CET 2003 - poeml@suse.de
|
||
|
||
- use the official MIME types, which are more complete [#23988]
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 24 18:17:02 CET 2003 - poeml@suse.de
|
||
|
||
- don't include log files into the package, and don't touch them in
|
||
%post; it's not needed
|
||
- fix comment in httpd.conf talking about SuSEconfig
|
||
- adjust some variable types in the sysconfig template
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 18 11:39:18 CET 2003 - poeml@suse.de
|
||
|
||
- apache2 Makefiles do support DESTDIR now, so let's use that
|
||
instead of the explicit paths (fixes a wrong path in
|
||
config_vars.mk [#23699]). Some files (*.exp, libapr*) are
|
||
automatically installed in the right location now.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Feb 14 16:39:40 CET 2003 - poeml@suse.de
|
||
|
||
- fix configuration script to find apache modules on 64 bit archs
|
||
- mark ssl.conf (noreplace)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 10 18:35:15 CET 2003 - poeml@suse.de
|
||
|
||
- add mod_ldap, mod_auth_ldap, but link only them against the LDAP
|
||
libs. Likewise, do not link everything against ssl libs. This way
|
||
we can avoid RPM package (and build) requirements on a lot of
|
||
libs for subversion and other packages that build on apache.
|
||
- move more code from SuSEconfig into rcapache2 (actually into
|
||
support scripts below /usr/share/apache2/, so apache2 can be
|
||
configured without starting it)
|
||
- improve full-server-status once again
|
||
- remove suse_loadmodule.conf from filelist
|
||
- remove obsolete README.modules
|
||
- rename LOADMODULES -> APACHE_MODULES
|
||
- add APACHE_BUFFERED_LOGS
|
||
- update README.SuSE
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jan 28 13:32:04 CET 2003 - poeml@suse.de
|
||
|
||
- rc.apache2
|
||
- add extreme-configtest (trying to run server as nobody, which
|
||
detects _all_ config errors)
|
||
- evaluate LOADMODULES from sysconfig.apache2 on-the-fly from
|
||
rcapache2 instead of SuSEconfig
|
||
- when restarting, do something useful instead of 'sleep 3': wait
|
||
just as long until the server has terminated all children
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jan 26 21:27:31 CET 2003 - poeml@suse.de
|
||
|
||
- build mod_logio, mod_case_filter, mod_case_filter_in
|
||
- rename apr subpackage to libapr0 (the library is called libapr-0
|
||
meanwhile). add compatibility links named (libapr{,util}.so.0)
|
||
- configure SSL session caching with shm circular buffer
|
||
SSLSessionCache shm:/var/lib/httpd/ssl_scache
|
||
SSLSessionCacheTimeout 600
|
||
SSLMutex sem
|
||
- SuSEconfig.apache2: prefer prefork MPM over worker, if guessing
|
||
- strip objects
|
||
- rename gensslcert2 to gensslcert
|
||
- show a list all available modules in /etc/sysconfig/apache2
|
||
- nicer output of apache2ctl
|
||
- reorder Requires
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jan 23 12:05:59 CET 2003 - poeml@suse.de
|
||
|
||
- update to 2.0.44
|
||
- obsoletes patch httpd-2.0.43-mod_ssl-memory-leak.dif
|
||
- the apachectl and httpd man pages have been dropped upstreams
|
||
- add robots.txt to the example-pages subpackage that blocks spiders
|
||
- disable the perchild MPM
|
||
- disable httpd-2.0.36-64bit.dif
|
||
- rename apachectl2 to apache2ctl
|
||
- write the startup log to /var/tmp instead of /var/log/apache2
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jan 12 22:52:50 CET 2003 - poeml@suse.de
|
||
|
||
- fix last fix (rpm macro before hash wasn't expanded)
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 10 02:35:58 CET 2003 - poeml@suse.de
|
||
|
||
- fix lib64 path in SuSEconfig
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Jan 3 23:01:14 CET 2003 - poeml@suse.de
|
||
|
||
- fix typo in spec file, preventing replacement of @userdir@ in
|
||
httpd.conf-std.in
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Dec 18 15:11:53 CET 2002 - poeml@suse.de
|
||
|
||
- sysconfig.apache2:
|
||
- add APACHE_SERVER_FLAGS variable
|
||
- change default: APACHE_SERVERSIGNATURE=on to match apache deflt
|
||
- add APACHE_CONF_INCLUDE_DIRS
|
||
- drop bogus APACHE_ACCESS_SERVERINFO variable
|
||
- adapt to our new sysconfig template
|
||
- SuSEconfig.apache2:
|
||
- understand LOADMODULES also if it is not an array [#21816]
|
||
- be very flexible with regard to LOADMODULE input (e.g., say
|
||
mod_php4 and it will find libphp4.so with ID php4_module)
|
||
- also ignore *,v files
|
||
- include APACHE_CONF_INCLUDE_DIRS
|
||
- dump some files: suse_define.conf (not needed) & suse_text.conf
|
||
(too much overhead)
|
||
- rc.apache2:
|
||
- implement most of apachectl's commands (graceful, configtest)
|
||
- use server_flags from sysconfig.apache2
|
||
- pass server flags like -DSTATUS from the command line through
|
||
to httpd2
|
||
- add commmands to show the server status
|
||
- don't quit silently when no apache MPM is installed
|
||
- handle ServerSignature and other stuff on the command line
|
||
(save modifications to httpd.conf)
|
||
- fix the /manual Alias that points to the documentation
|
||
- configure /cgi-bin for cgi execution
|
||
- configure /home/*/public_html for mod_userdir -- if it is loaded
|
||
- configure internationalized error responses
|
||
- fix apachectl2
|
||
- add /etc/apache2/{,modules} to the filelist
|
||
- add /etc/apache2/conf.d as drop-in directory for packages
|
||
- hard code some more default paths into the executable
|
||
- finally, run a test!
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 5 13:55:06 CET 2002 - poeml@suse.de
|
||
|
||
- move ap{r,u}-config* into the apr package, as well
|
||
- add generic ap{r,u}-config
|
||
- add %includedir to filelist
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 5 00:26:22 CET 2002 - poeml@suse.de
|
||
|
||
- more checks and warnings to SuSEconfig.apache2
|
||
- shift APR files into the the apr package
|
||
- try 1.136 revision of perchild.c
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Dec 3 16:27:35 CET 2002 - poeml@suse.de
|
||
|
||
- add forgotten ssl.conf to the filelist (thanks, Robert)
|
||
- add httpd-2.0.43-mod_ssl-memory-leak.dif
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 14 19:34:38 CEST 2002 - poeml@suse.de
|
||
|
||
- update to 2.0.43, that fixes a Cross-Site Scripting bug (CVE:
|
||
CAN-2002-0840)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Oct 7 09:39:45 CEST 2002 - poeml@suse.de
|
||
|
||
- do not append a '2' suffix to the scripts included with the
|
||
documentation
|
||
- move error, icons and manual dir to /usr/share/apache2
|
||
- fix nested array in SuSEconfig.apache2
|
||
- let SuSEconfig pick one MPM that is installed. Do not default to
|
||
"worker". [#20724]
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 3 14:50:20 CEST 2002 - poeml@suse.de
|
||
|
||
- update to 2.0.42 (primarily a bug-fix release, including updates
|
||
to the experimental caching module, the removal of several memory
|
||
leaks, and fixes for several segfaults, one of which could have
|
||
been used as a denial-of-service against mod_dav (VU#406121).)
|
||
- increase flexibility of the spec file: build any set of MPMs,
|
||
depending on RPM %defines. Improve the mechanism that merges the
|
||
modules so it works with any number of MPMs.
|
||
- use a "Server:" header that fits the product apache is built for
|
||
- add an RPM dependency on the module magic number to the MPM
|
||
subpackages
|
||
- build the "leader/follower" MPM. On i686, enable nonportable but
|
||
faster atomics for it.
|
||
- use filelists for more flexibility. APRVARS ceased to exist.
|
||
Don't add README* twice.
|
||
- perchild: use AcceptMutex fcntl to prevent permission conflict as
|
||
suggested in Apache Bugzilla #7921
|
||
- remove mod_rewrite and mod_proxy from the default modules
|
||
- build the mod_auth_digest module
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Sep 9 15:30:34 CEST 2002 - poeml@suse.de
|
||
|
||
- add patch that changes PLATFORM (as seen in the HTTP Server
|
||
header) from "Unix" to "SuSE/Linux" [#18543]
|
||
- add README.SuSE, explaining how to build modules with apxs2
|
||
- fixed some paths in README.modules, put it into docdir and mark
|
||
it as %doc
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 28 16:39:59 CEST 2002 - poeml@suse.de
|
||
|
||
- new package, now building all three MPMs and putting all specific
|
||
modules in specific directories. Branch a subpackage for each
|
||
MPM, containing the server and MPM-specific modules.
|
||
- branch apr package off, so apache2 doesn't need to be installed
|
||
to have the libs. (apr is not released yet, that's why we build
|
||
it here)
|
||
- allow coexistence of apache1 by using directories named apache2
|
||
or suffixed with "2"
|
||
- allow building modules via apxs2 (for all server MPMs) --- or via
|
||
apxs2-{worker,perchild,prefork} for a specific server MPM
|
||
- add permissions.apache2 setting /usr/sbin/suexec2 to 4755
|
||
- rewrite SuSEconfig.apache2 for apache 2.
|
||
- add httpd-2.0.40-cache_util.c.diff that prevents a segfault in
|
||
mod_proxy when given an invalid URL
|
||
- branch apache2-example-pages off (docroot contents)
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Aug 19 16:43:37 CEST 2002 - poeml@suse.de
|
||
|
||
- actually use the new SuSE81 layout, and add SuSE81_64 layout
|
||
- cleaned up httpd-2.0.36-conf.dif
|
||
- fixed comment in SuSEconfig.apache
|
||
- drop SuSEconfig subpackage
|
||
- split main package and -devel package in three packages, one for
|
||
each MPM...
|
||
apache2 -> apache2-{worker,perchild,prefork}
|
||
apache2-devel -> apache2-{worker,perchild,prefork}-devel
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Aug 12 17:47:08 CEST 2002 - poeml@suse.de
|
||
|
||
- bugfix update to 2.0.40
|
||
- fix Requires of -devel subpackage
|
||
- add variable to sysconfig.apache to switch off SuSEconfig.apache
|
||
- add new layout SUSE81 to config.layout due to the moved server
|
||
root (so the old SuSE6.1 can be kept for building on older
|
||
distributions)
|
||
- one of the lib64 path fixes could be removed, now included
|
||
upstream
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 7 18:47:33 CEST 2002 - poeml@suse.de
|
||
|
||
- put PreReq in an if-statement to allow building on older distris
|
||
- relax the Requires
|
||
- the apache_mmn macro had to be moved down in the spec file to be
|
||
evaluated
|
||
- libmm is not needed for building (and it is not threadsafe)
|
||
- fix config.layout for the moved server root
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 2 23:44:31 CEST 2002 - poeml@suse.de
|
||
|
||
- fix libdir in config.layout for lib64
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Aug 2 12:22:33 CEST 2002 - poeml@suse.de
|
||
|
||
- fix RPM Requires
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 1 17:50:53 CEST 2002 - poeml@suse.de
|
||
|
||
- move datadir (i.e., ServerRoot) from /usr/local/httpd to /srv/www
|
||
- drop obsolete README.SuSE
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Aug 1 01:01:32 CEST 2002 - poeml@suse.de
|
||
|
||
- spec file: use PreReq
|
||
- don't delete SuSEconfig's md5 files in %post, that's no good
|
||
- add apache.logrotate
|
||
- provide the magic module number as executable script
|
||
(/usr/lib/apache/MMN) and as RPM Provides, indicating API changes
|
||
- mark httpd.conf noreplace
|
||
- fix installbuilddir in config.layout, needed for apxs
|
||
|
||
-------------------------------------------------------------------
|
||
Sun Jul 14 15:27:24 CEST 2002 - poeml@suse.de
|
||
|
||
- update to 2.0.39
|
||
- drop obsolete moduledir and apxs patches
|
||
- rc.apache INIT section: use X-UnitedLinux-Should-Start
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jul 3 01:53:35 CEST 2002 - ro@suse.de
|
||
|
||
- rename to "apache2" again
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 11 17:02:47 CEST 2002 - ro@suse.de
|
||
|
||
- get apxs to work:
|
||
include needed files in devel package
|
||
adapt some pathes in apxs
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 29 18:16:00 CEST 2002 - poeml@suse.de
|
||
|
||
- update to 2.0.36
|
||
- drop mod_ssl subpackage; mod_ssl is part of the apache bsae
|
||
distribution now
|
||
- RPM can be built as user now
|
||
- SuSEconfig.apache: understand relative and absolute pathnames
|
||
- disable experimental auth_digest_module
|