Skip to content
CHANGES 155 KiB
Newer Older
                                                         -*- coding: utf-8 -*-
Ruediger Pluem's avatar
Ruediger Pluem committed

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.10

  *) mod_cache: Fix AH00784 errors on Windows when the the CacheLock directive
     is enabled.  [Eric Covener]

  *) mod_expires: don't add Expires header to error responses (4xx/5xx),
     be they generated or forwarded. PR 55669. [ Yann Ylavic ]

  *) mod_proxy_fcgi: Don't segfault when failing to connect to the backend.
     (regression in 2.4.9 release) [Jeff Trawick]

  *) mod_authn_socache: Fix crash at startup in certain configurations.
     PR 56371. (regression in 2.4.7) [Jan Kaluza]

Daniel Gruno's avatar
Daniel Gruno committed
  *) mod_lua: Enforce the max post size allowed via r:parsebody()
     [Daniel Gruno]

  *) mod_lua: Use binary comparison to find boundaries for multipart 
     objects, as to not terminate our search prematurely when hitting
     a NULL byte. [Daniel Gruno]

  *) mod_ssl: add workaround for SSLCertificateFile when using OpenSSL
     versions before 0.9.8h and not specifying an SSLCertificateChainFile
     (regression introduced with 2.4.8). PR 56410. [Kaspar Brand]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: bring SNI behavior into better conformance with RFC 6066:
     no longer send warning-level unrecognized_name(112) alerts,
     and limit startup warnings to cases where an OpenSSL version
     without TLS extension support is used. PR 56241. [Kaspar Brand]

  *) mod_proxy_html: Avoid some possible memory access violation in case of
     specially crafted files, when the ProxyHTMLMeta directive is turned on.
     Follow up of PR 56287 [Christophe Jaillet]

  *) mod_auth_form: Make sure the optional functions are loaded even when
     the AuthFormProvider isn't specified. [Graham Leggett]

  *) mod_ssl: avoid processing bogus SSLCertificateKeyFile values
     (and logging garbled file names). PR 56306. [Kaspar Brand]

  *) mod_ssl: fix merging of global and vhost-level settings with the
     SSLCertificateFile, SSLCertificateKeyFile, and SSLOpenSSLConfCmd
     directives. PR 56353. [Kaspar Brand]

  *) mod_headers: Allow the "value" parameter of Header and RequestHeader to 
     contain an ap_expr expression if prefixed with "expr=". [Eric Covener]

Joe Orton's avatar
Joe Orton committed
  *) rotatelogs: Avoid creation of zombie processes when -p is used on
     Unix platforms.  [Joe Orton]

Jeff Trawick's avatar
Jeff Trawick committed
  *) mod_authnz_fcgi: New module to enable FastCGI authorizer
     applications to authenticate and/or authorize clients.
     [Jeff Trawick]

  *) mod_proxy: Do not try to parse the regular expressions passed by
     ProxyPassMatch as URL as they do not follow their syntax.
     PR 56074. [Ruediger Pluem]

  *) mod_reqtimeout: Resolve unexpected timeouts on keepalive requests 
     under the Event MPM. PR56216.  [Frank Meier <frank meier ergon ch>]

  *) mod_proxy_fcgi: Fix sending of response without some HTTP headers
     that might be set by filters.  [Jim Riggs <jim riggs.me>]

  *) mod_proxy_html: Do not delete the wrong data from HTML code when a
     "http-equiv" meta tag specifies a Content-Type behind any other
     "http-equiv" meta tag. PR 56287 [Micha Lenk <micha lenk info>]

  *) Add suspend_connection and resume_connection hooks to notify modules
     when the thread/connection relationship changes.  (Should be implemented
     for any third-party async MPMs.)  [Jeff Trawick]

  *) mod_proxy_wstunnel: Don't issue AH02447 and log a 500 on routine 
     hangups from websockets origin servers. PR 56299
     [Yann Ylavic, Edward Lu <Chaosed0 gmail com>, Eric Covener] 

  *) mod_proxy_wstunnel: Don't pool backend websockets connections,
     because we need to handshake every time. PR 55890.
     [Eric Covener]

  *) mod_lua: Redesign how request record table access behaves,
     in order to utilize the request record from within these tables.
  *) mod_lua: Add r:wspeek for peeking at WebSocket frames. [Daniel Gruno]
  *) mod_lua: Log an error when the initial parsing of a Lua file fails.
Daniel Gruno's avatar
Daniel Gruno committed
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]
  *) mod_lua: Reformat and escape script error output.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: URL-escape cookie keys/values to prevent tainted cookie data
     from causing response splitting.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: Disallow newlines in table values inside the request_rec, 
     to prevent HTTP Response Splitting via tainted headers.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.9

Jim Jagielski's avatar
Jim Jagielski committed
  *) mod_ssl: Work around a bug in some older versions of OpenSSL that
     would cause a crash in SSL_get_certificate for servers where the
     certificate hadn't been sent. [Stephen Henson]
Jim Jagielski's avatar
Jim Jagielski committed
  *) mod_lua: Add a fixups hook that checks if the original request is intended 
     for LuaMapHandler. This fixes a bug where FallbackResource invalidates the 
     LuaMapHandler directive in certain cases by changing the URI before the map 
     handler code executes [Daniel Gruno, Daniel Ferradal <dferradal gmail com>].
Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.8

Jim Jagielski's avatar
Jim Jagielski committed
  *) SECURITY: CVE-2014-0098 (cve.mitre.org)
     Clean up cookie logging with fewer redundant string parsing passes.
     Log only cookies with a value assignment. Prevents segfaults when
Jim Jagielski's avatar
Jim Jagielski committed
     logging truncated cookies.
     [William Rowe, Ruediger Pluem, Jim Jagielski]

Jim Jagielski's avatar
Jim Jagielski committed
  *) SECURITY: CVE-2013-6438 (cve.mitre.org)
     mod_dav: Keep track of length of cdata properly when removing
     leading spaces. Eliminates a potential denial of service from
     specifically crafted DAV WRITE requests
     [Amin Tora <Amin.Tora neustar.biz>]
Jim Jagielski's avatar
Jim Jagielski committed

Jim Jagielski's avatar
Jim Jagielski committed
  *) core: Support named groups and backreferences within the LocationMatch,
     DirectoryMatch, FilesMatch and ProxyMatch directives. (Requires
     non-ancient PCRE library) [Graham Leggett]

  *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
     TE/CL conflicts. [Yann Ylavic, Jim Jagielski]

  *) core: Detect incomplete request and response bodies, log an error and
     forward it to the underlying filters. PR 55475 [Yann Ylavic]
  *) mod_dir: Add DirectoryCheckHandler to allow a 2.2-like behavior, skipping 
     execution when a handler is already set. PR53929. [Eric Covener]

  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
     forward proxy request. [Ruediger Pluem]

  *) mod_ssl: Remove the hardcoded algorithm-type dependency for the
     SSLCertificateFile and SSLCertificateKeyFile directives, to enable
     future algorithm agility, and deprecate the SSLCertificateChainFile
     directive (obsoleted by SSLCertificateFile). [Kaspar Brand]

  *) mod_rewrite: Add RewriteOptions InheritDown, InheritDownBefore, 
     and IgnoreInherit to allow RewriteRules to be pushed from parent scopes
     to child scopes without explicitly configuring each child scope.
     PR56153.  [Edward Lu <Chaosed0 gmail com>] 

  *) prefork: Fix long delays when doing a graceful restart.
     PR 54852 [Jim Jagielski, Arkadiusz Miskiewicz <arekm maven pl>]

  *) FreeBSD: Disable IPv4-mapped listening sockets by default for versions
     5+ instead of just for FreeBSD 5. PR 53824. [Jeff Trawick]

  *) mod_proxy_wstunnel: Avoid busy loop on client errors, drop message
     IDs 02445, 02446, and 02448 to TRACE1 from DEBUG. PR 56145.
     [Joffroy Christen <joffroy.christen solvaxis com>, Eric Covener]

  *) mod_remoteip: Correct the trusted proxy match test. PR 54651.
     [Yoshinori Ehara <yoshinori ehara gmail com>, Eugene L <eugenel amazon com>]

  *) mod_proxy_fcgi: Fix error message when an unexpected protocol version
     number is received from the application.  PR 56110.  [Jeff Trawick]

  *) mod_remoteip: Use the correct IP addresses to populate the proxy_ips field.
     PR 55972. [Mike Rumph]

  *) mod_lua: Update r:setcookie() to accept a table of options and add domain,
     path and httponly to the list of options available to set.
     PR 56128 [Edward Lu <Chaosed0 gmail com>, Daniel Gruno]
     
Eric Covener's avatar
Eric Covener committed
  *) mod_lua: Fix r:setcookie() to add, rather than replace,
     the Set-Cookie header. PR56105
     [Kevin J Walters <kjw ms com>, Edward Lu <Chaosed0 gmail com>]

Daniel Gruno's avatar
Daniel Gruno committed
  *) mod_lua: Allow for database results to be returned as a hash with 
     row-name/value pairs instead of just row-number/value. [Daniel Gruno]

  *) mod_rewrite: Add %{CONN_REMOTE_ADDR} as the non-useragent counterpart to
     %{REMOTE_ADDR}. PR 56094. [Edward Lu <Chaosed0 gmail com>]

  *) WinNT MPM: If ap_run_pre_connection() fails or sets c->aborted, don't
     save the socket for reuse by the next worker as if it were an 
     APR_SO_DISCONNECTED socket. Restores 2.2 behavior. [Eric Covener]

Eric Covener's avatar
Eric Covener committed
  *) mod_dir: Don't search for a DirectoryIndex or DirectorySlash on a URL
     that was just rewritten by mod_rewrite. PR53929. [Eric Covener]

  *) mod_session: When we have a session we were unable to decode,
     behave as if there was no session at all. [Thomas Eckert
     <thomas.r.w.eckert gmail com>]

  *) mod_session: Fix problems interpreting the SessionInclude and
     SessionExclude configuration. PR 56038. [Erik Pearson
     <erik adaptations.com>]
Loading full blame...