Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
To: users@httpd.apache.org
References: <135728da20984063820d24157ec3b3a0@BC1Mail1.SpeedLine.local>
 <o4h828$sai$1@blaine.gmane.org>
From: Rainer Jung <rainer.jung@kippdata.de>
Message-ID: <5ef20570-8164-6fb2-bf67-0e3026567a55@kippdata.de>
Date: Wed, 4 Jan 2017 13:05:51 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.6.0
MIME-Version: 1.0
In-Reply-To: <o4h828$sai$1@blaine.gmane.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [users@httpd] Re: Next version of Apache 2.2?
archived-at: Wed, 04 Jan 2017 12:06:04 -0000

Am 03.01.2017 um 23:19 schrieb Good guy:
> On 03/01/2017 21:31, Development Manager wrote:
>> CVE-2016-8743 was patched/mitigated in Apache 2.4 but is still an
>> outstanding issue in 2.2, according to
>> https://security-tracker.debian.org/tracker/CVE-2016-8743.
>>
>> Is there a plan to rebase it to 2.2? If so, do you know when?
>> The reason I ask is PCI DSS requires that we have all vulnerabilities
>> patched within 30 days, and it's been 2 weeks since 2.4 was patched.
>>
> 2.2 is dead and finished.  It is time to move to 2.4.  Nobody is working
> on 2.2 as far as I know.

The backport vote for the fix is ongoing and likely there will be a 
release soon after the fix will have been voted into 2.2. But it might 
be it will be published after your 30 days deadline.

In general "yes": if you can, you should migrate to 2.4.

Regards,

Rainer

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org