httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From wr...@apache.org
Subject svn commit: r4744 - in /dev/httpd: CHANGES_2.2 CHANGES_2.2.26 CHANGES_2.2.27
Date Tue, 18 Mar 2014 19:57:20 GMT
Author: wrowe
Date: Tue Mar 18 19:57:20 2014
New Revision: 4744

Log:
Prep 2.2.27 CHANGES

Added:
    dev/httpd/CHANGES_2.2.27
Removed:
    dev/httpd/CHANGES_2.2.26
Modified:
    dev/httpd/CHANGES_2.2

Modified: dev/httpd/CHANGES_2.2
==============================================================================
--- dev/httpd/CHANGES_2.2 (original)
+++ dev/httpd/CHANGES_2.2 Tue Mar 18 19:57:20 2014
@@ -1,4 +1,39 @@
                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.2.27
+
+  *) SECURITY: CVE-2014-0098 (cve.mitre.org)
+     Clean up cookie logging with fewer redundant string parsing passes.
+     Log only cookies with a value assignment. Prevents segfaults when
+     logging truncated cookies.
+     [William Rowe, Ruediger Pluem, Jim Jagielski]
+
+  *) SECURITY: CVE-2013-6438 (cve.mitre.org)
+     mod_dav: Keep track of length of cdata properly when removing
+     leading spaces. Eliminates a potential denial of service from
+     specifically crafted DAV WRITE requests
+     [Amin Tora <Amin.Tora neustar.biz>]
+
+  *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
+     TE/CL conflicts. [Yann Ylavic <ylavic.dev gmail com>, Jim Jagielski]
+
+  *) mod_proxy_http: Core dumped under high load. PR 50335.
+     [Jan Kaluza <jkaluza redhat.com>]
+
+  *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+     [Christophe Jaillet]
+
+  *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which
+     is equivalent to <ProxyMatch wildcard-url>. [Christophe Jaillet]
+
+  *) mod_ldap: Fix a potential memory leak or corruption.  PR 54936.
+     [Zhenbo Xu <zhenbo1987 gmail com>]
+
+  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
+     forward proxy request. [Ruediger Pluem]
+
+  *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows. 
+     PR46679 [Bob Ionescu]
+
 Changes with Apache 2.2.26
 
   *) mod_dav: dav_resource->uri treated as unencoded. This was an
@@ -994,6 +1029,8 @@ Changes with Apache 2.2.10
      mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
      the FTP URL. Discovered by Marc Bevand of Rapid7. [Ruediger Pluem]
 
+  *) mod_authz_host: Add support for env=!envvar [Jim Jagielski]
+
   *) Allow for smax to be 0 for balancer members so that all idle
      connections are able to be dropped should they exceed ttl.
      PR 43371 [Phil Endecott <spam_from_apache_bugzilla chezphil.org>,

Added: dev/httpd/CHANGES_2.2.27
==============================================================================
--- dev/httpd/CHANGES_2.2.27 (added)
+++ dev/httpd/CHANGES_2.2.27 Tue Mar 18 19:57:20 2014
@@ -0,0 +1,36 @@
+                                                         -*- coding: utf-8 -*-
+Changes with Apache 2.2.27
+
+  *) SECURITY: CVE-2014-0098 (cve.mitre.org)
+     Clean up cookie logging with fewer redundant string parsing passes.
+     Log only cookies with a value assignment. Prevents segfaults when
+     logging truncated cookies.
+     [William Rowe, Ruediger Pluem, Jim Jagielski]
+
+  *) SECURITY: CVE-2013-6438 (cve.mitre.org)
+     mod_dav: Keep track of length of cdata properly when removing
+     leading spaces. Eliminates a potential denial of service from
+     specifically crafted DAV WRITE requests
+     [Amin Tora <Amin.Tora neustar.biz>]
+
+  *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
+     TE/CL conflicts. [Yann Ylavic <ylavic.dev gmail com>, Jim Jagielski]
+
+  *) mod_proxy_http: Core dumped under high load. PR 50335.
+     [Jan Kaluza <jkaluza redhat.com>]
+
+  *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+     [Christophe Jaillet]
+
+  *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which
+     is equivalent to <ProxyMatch wildcard-url>. [Christophe Jaillet]
+
+  *) mod_ldap: Fix a potential memory leak or corruption.  PR 54936.
+     [Zhenbo Xu <zhenbo1987 gmail com>]
+
+  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
+     forward proxy request. [Ruediger Pluem]
+
+  *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows. 
+     PR46679 [Bob Ionescu]
+



Mime
View raw message