Return-Path: <cvs-return-60851-archive-asf-public=cust-asf.ponee.io@httpd.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id 2BF72200CA6
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Tue, 13 Jun 2017 18:49:04 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id 2A849160BE9; Tue, 13 Jun 2017 16:49:04 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 52AAC160BC5
	for <archive-asf-public@cust-asf.ponee.io>; Tue, 13 Jun 2017 18:49:03 +0200 (CEST)
Received: (qmail 95082 invoked by uid 500); 13 Jun 2017 16:49:02 -0000
Mailing-List: contact cvs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
list-help: <mailto:cvs-help@httpd.apache.org>
list-unsubscribe: <mailto:cvs-unsubscribe@httpd.apache.org>
List-Post: <mailto:cvs@httpd.apache.org>
List-Id: <cvs.httpd.apache.org>
Delivered-To: mailing list cvs@httpd.apache.org
Received: (qmail 95073 invoked by uid 99); 13 Jun 2017 16:49:02 -0000
Received: from Unknown (HELO svn01-us-west.apache.org) (209.188.14.144)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 13 Jun 2017 16:49:02 +0000
Received: from svn01-us-west.apache.org (localhost [127.0.0.1])
	by svn01-us-west.apache.org (ASF Mail Server at svn01-us-west.apache.org) with ESMTP id 694D63A00A7
	for <cvs@httpd.apache.org>; Tue, 13 Jun 2017 16:49:01 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: svn commit: r20020 - in /dev/httpd: Announcement2.4.html Announcement2.4.txt
Date: Tue, 13 Jun 2017 16:48:59 -0000
To: cvs@httpd.apache.org
From: jim@apache.org
X-Mailer: svnmailer-1.0.9
Message-Id: <20170613164901.694D63A00A7@svn01-us-west.apache.org>
archived-at: Tue, 13 Jun 2017 16:49:04 -0000

Author: jim
Date: Tue Jun 13 16:48:59 2017
New Revision: 20020

Log:
Prep

Modified:
    dev/httpd/Announcement2.4.html
    dev/httpd/Announcement2.4.txt

Modified: dev/httpd/Announcement2.4.html
==============================================================================
--- dev/httpd/Announcement2.4.html (original)
+++ dev/httpd/Announcement2.4.html Tue Jun 13 16:48:59 2017
@@ -49,7 +49,7 @@
 <div class="banner"></div>
 
 <h1>
-                       Apache HTTP Server 2.4.25 Released
+                       Apache HTTP Server 2.4.26 Released
 </h1>
 <p>
    December 20, 2016
@@ -57,46 +57,19 @@
 <p>
    The Apache Software Foundation and the Apache HTTP Server Project are
    pleased to <a href="http://www.apache.org/dist/httpd/Announcement2.4.html">announce</a>
-   the release of version 2.4.25 of the Apache
+   the release of version 2.4.26 of the Apache
    HTTP Server ("Apache").  This version of Apache is our latest GA
    release of the new generation 2.4.x branch of Apache HTTPD and
    represents fifteen years of innovation by the project, and is
    recommended over all previous releases. This release of Apache is
-   a security, feature, and bug fix release, and addresses these 
-   specific security defects as well as other fixes:
-</p>
-<ul>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0736">CVE-2016-0736</a>
-     mod_session_crypto: Authenticate the session data/cookie with a
-     MAC (SipHash) to prevent deciphering or tampering with a padding
-     oracle attack.
-</li>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2161">CVE-2016-2161</a>
-     mod_auth_digest: Prevent segfaults during client entry allocation
-     when the shared memory space is exhausted.
-</li>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5387">CVE-2016-5387</a>
-     core: Mitigate [f]cgi "httpoxy" issues.
-</li>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740">CVE-2016-8740</a>
-     mod_http2: Mitigate DoS memory exhaustion via endless
-     CONTINUATION frames.
-</li>
-<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8743">CVE-2016-8743</a>
-     Enforce HTTP request grammar corresponding to RFC7230 for request
-     lines and request headers, to prevent response splitting and cache
-     pollution by malicious clients or downstream proxies.
-</li>
-</ul>
-<p>
-   NOTE: version 2.4.24 was not released.
+   a security, feature, and bug fix release.
 </p>
 <p>
    We consider this release to be the best version of Apache available, and
    encourage users of all prior versions to upgrade.
 </p>
 <p>
-   Apache HTTP Server 2.4.25 is available for download from:
+   Apache HTTP Server 2.4.26 is available for download from:
 </p>
 <dl>
   <dd><a href="http://httpd.apache.org/download.cgi"
@@ -104,7 +77,7 @@
 </dl>
 <p>
    Please see the CHANGES_2.4 file, linked from the download page, for a
-   full list of changes.  A condensed list, CHANGES_2.4.25 includes only
+   full list of changes.  A condensed list, CHANGES_2.4.26 includes only
    those changes introduced since the prior 2.4 release.  A summary of all 
    of the security vulnerabilities addressed in this and earlier releases 
    is available:
@@ -115,9 +88,10 @@
   </dd>
 </dl>
 <p>
-   This release requires the Apache Portable Runtime (APR) version 1.5.x
-   and APR-Util version 1.5.x. The APR libraries must be upgraded for all
-   features of httpd to operate correctly.
+   This release requires the Apache Portable Runtime (APR), minimum version
+   1.5.x, and APR-Util, minimum version 1.5.x. Some features may require the 1.6.x
+   version of both APR and APR-Util. The APR libraries must be upgraded for
+   all features of httpd to operate correctly.
 </p>
 <p>
    Apache HTTP Server 2.4 provides a number of improvements and enhancements

Modified: dev/httpd/Announcement2.4.txt
==============================================================================
--- dev/httpd/Announcement2.4.txt (original)
+++ dev/httpd/Announcement2.4.txt Tue Jun 13 16:48:59 2017
@@ -1,43 +1,19 @@
-                Apache HTTP Server 2.4.25 Released
+                Apache HTTP Server 2.4.26 Released
 
-   December 20, 2016
+   June 19, 2017
 
    The Apache Software Foundation and the Apache HTTP Server Project
-   are pleased to announce the release of version 2.4.25 of the Apache
+   are pleased to announce the release of version 2.4.26 of the Apache
    HTTP Server ("Apache").  This version of Apache is our latest GA
    release of the new generation 2.4.x branch of Apache HTTPD and
    represents fifteen years of innovation by the project, and is
    recommended over all previous releases. This release of Apache is
-   a security, feature, and bug fix release, and addresses these 
-   specific security defects as well as other fixes:
+   a security, feature, and bug fix release.
 
-     CVE-2016-0736 (cve.mitre.org)
-     mod_session_crypto: Authenticate the session data/cookie with a
-     MAC (SipHash) to prevent deciphering or tampering with a padding
-     oracle attack.
-
-     CVE-2016-2161 (cve.mitre.org)
-     mod_auth_digest: Prevent segfaults during client entry allocation
-     when the shared memory space is exhausted.
-
-     CVE-2016-5387 (cve.mitre.org)
-     core: Mitigate [f]cgi "httpoxy" issues.
-
-     CVE-2016-8740 (cve.mitre.org)
-     mod_http2: Mitigate DoS memory exhaustion via endless
-     CONTINUATION frames.
-
-     CVE-2016-8743 (cve.mitre.org)
-     Enforce HTTP request grammar corresponding to RFC7230 for request
-     lines and request headers, to prevent response splitting and cache
-     pollution by malicious clients or downstream proxies.
-
-   NOTE: Version 2.4.24 was not released.
-   
    We consider this release to be the best version of Apache available, and
    encourage users of all prior versions to upgrade.
 
-   Apache HTTP Server 2.4.25 is available for download from:
+   Apache HTTP Server 2.4.26 is available for download from:
 
      http://httpd.apache.org/download.cgi
 
@@ -48,16 +24,17 @@
      http://httpd.apache.org/docs/trunk/new_features_2_4.html
 
    Please see the CHANGES_2.4 file, linked from the download page, for a
-   full list of changes. A condensed list, CHANGES_2.4.25 includes only
+   full list of changes. A condensed list, CHANGES_2.4.26 includes only
    those changes introduced since the prior 2.4 release.  A summary of all 
    of the security vulnerabilities addressed in this and earlier releases 
    is available:
 
      http://httpd.apache.org/security/vulnerabilities_24.html
 
-   This release requires the Apache Portable Runtime (APR) version 1.5.x
-   and APR-Util version 1.5.x. The APR libraries must be upgraded for all
-   features of httpd to operate correctly.
+   This release requires the Apache Portable Runtime (APR), minimum
+   version 1.5.x, and APR-Util, minimum version 1.5.x. Some features may
+   require the 1.6.x version of both APR and APR-Util. The APR libraries
+   must be upgraded for all features of httpd to operate correctly.
 
    This release builds on and extends the Apache 2.2 API.  Modules written
    for Apache 2.2 will need to be recompiled in order to run with Apache