Newer
Older
core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
with the INCLUDES filter active, introduced in 2.4.11. PR 57531.
[Yann Ylavic]
*) SECURITY: CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.
[Edward Lu <Chaosed0 gmail.com>]
*) build: Don't load mod_cgi and mod_cgid in the default configuration
if they're both built. [olli hauer <ohauer gmx.de>]
*) mod_logio: Add LogIOTrackTTFB and %^FB logformat to log the time
taken to start writing response headers. [Eric Covener]
*) mod_ssl: Avoid compilation errors with LibreSSL related to
the use of ENGINE_CTRL_CHIL_SET_FORKCHECK.
[Stuart Henderson <sthen openbsd.org>]
*) mod_proxy_http: Use the "Connection: close" header for requests to
backends not recycling connections (disablereuse), including the default
reverse and forward proxies. [Yann Ylavic]
*) mod_proxy: Add ap_connection_reusable() for checking if a connection
is reusable as of this point in processing. [Jeff Trawick]
*) mod_proxy_wstunnel: Avoid an empty response by failing with 502 (Bad
Gateway) when no response is ever received from the backend.
[Jan Kaluza]
*) core_filters: restore/disable TCP_NOPUSH option after non-blocking
Joe Orton
committed
sendfile. [Yann Ylavic]
*) core: Initialize scoreboard's used optional functions on graceful restarts
to avoid a crash when relocation occurs. PR 57177. [Yann Ylavic]
*) mod_dav: Avoid a potential integer underflow in the lock timeout value sent
back to a client. The answer to a LOCK request could be an extremly large
integer if the time needed to lock the resource was longer that the
requested timeout given in the LOCK request. In such a case, we now answer
"Second-0". PR55420
[Christophe Jaillet]
*) mod_cgid: Within the first minute of a server start or restart,
allow mod_cgid to retry connecting to its daemon process. Previously,
'No such file or directory: unable to connect to cgi daemon...' could
be logged without an actual retry. PR57685.
[Edward Lu <Chaosed0 gmail.com>]
*) mod_proxy: use the original (non absolute) form of the request-line's URI
for requests embedded in CONNECT payloads used to connect SSL backends via
a ProxyRemote forward-proxy. PR 55892. [Hendrik Harms <hendrik.harms
gmail com>, William Rowe, Yann Ylavic]
*) mod_proxy_connect/wstunnel: If both client and backend sides get readable
at the same time, don't lose errors occuring while forwarding on the first
side when none occurs next on the other side, and abort. [Yann Ylavic]
*) mod_rewrite: Improve relative substitutions in per-directory/htaccess
context for directories found by mod_userdir and mod_alias. These no
longer require RewriteBase to be specified. [Eric Covener]
*) mod_proxy_http: Don't expect the backend to ack the "Connection: close" to
finally close those not meant to be kept alive by SetEnv proxy-nokeepalive
or force-proxy-request-1.0. [Yann Ylavic]
*) core: If explicitly configured, use the KeepaliveTimeout value of the
virtual host which handled the latest request on the connection, or by
default the one of the first virtual host bound to the same IP:port.
PR56226. [Yann Ylavic]
*) mod_lua: After a r:wsupgrade(), mod_lua was not properly
responding to a websockets PING but instead invoking the specified
script. PR57524. [Edward Lu <Chaosed0 gmail.com>]
*) mod_ssl: Add the SSL_CLIENT_CERT_RFC4523_CEA variable, which provides
a combination of certificate serialNumber and issuer as defined by
CertificateExactMatch in RFC4523. [Graham Leggett]
*) core: Add expression support to ErrorDocument. Switch from a fixed
sized 664 byte array per merge to a hash table. [Graham Leggett]
*) ab: Add missing longest request (100%) to CSV export.
[Marcin Fabrykowski <bugzilla fabrykowski.pl>]
*) mod_macro: Clear macros before initialization to avoid use-after-free
on startup or restart when the module is linked statically. PR 57525
[apache.org tech.futurequest.net, Yann Ylavic]
*) mod_alias: Introduce expression parser support for Alias, ScriptAlias
and Redirect. [Graham Leggett]
*) mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context.
PR 57100. [Michael Kaufmann <apache-bugzilla michael-kaufmann.ch>,
Yann Ylavic]
*) mpm_event: Avoid access to the scoreboard from the connection while
it is suspended (waiting for events). [Eric Covener, Jeff Trawick]
*) mod_ssl: Fix renegotiation failures redirected to an ErrorDocument.
PR 57334. [Yann Ylavic].
*) mod_deflate: A misplaced check prevents limiting small bodies with the
new inflate limits. PR56872. [Edward Lu, Eric Covener, Yann Ylavic]
*) mod_proxy_ajp: Forward SSL protocol name (SSLv3, TLSv1.1 etc.) as a
request attribute to the backend. Recent Tomcat versions will extract
it and provide it as a servlet request attribute named
"org.apache.tomcat.util.net.secure_protocol_version". [Rainer Jung]
*) core: Optimize string concatenation in expression parser when evaluating
a string expression. [Rainer Jung]
*) acinclude.m4: Generate #LoadModule directive in default httpd.conf for
every --enable-mpms-shared. PR 53882. [olli hauer <ohauer gmx.de>,
Yann Ylavic]
*) mod_authn_dbd: Fix the error message logged in case of error while querying
the database. This is associated to AH01656 and AH01661. [Christophe Jaillet]
*) mod_authz_groupfile: Reduce the severity of AH01667 from ERROR to DEBUG,
because it may be evaluated inside <RequireAny>. PR55523. [Eric Covener]
*) mpm_winnt: Accept utf-8 (Unicode) service names and descriptions for
internationalization. [William Rowe]
*) mpm_winnt: Normalize the error and status messages emitted by service.c,
the service control interface for Windows. [William Rowe]
*) configure: Fix --enable-v4-mapped configuration on *BSD. PR 53824.
[ olli hauer <ohauer gmx.de>, Yann Ylavic ]
*) Reverted <DirectoryMatch > behavior regression introduced in 2.4.11
(not released).
*) SECURITY: CVE-2014-3583 (cve.mitre.org)
mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with
response headers' size above 8K. [Yann Ylavic, Jeff Trawick]
*) SECURITY: CVE-2014-3581 (cve.mitre.org)
mod_cache: Avoid a crash when Content-Type has an empty value.
PR 56924. [Mark Montague <mark catseye.org>, Jan Kaluza]
*) SECURITY: CVE-2014-8109 (cve.mitre.org)
mod_lua: Fix handling of the Require line when a LuaAuthzProvider is
used in multiple Require directives with different arguments.
PR57204 [Edward Lu <Chaosed0 gmail.com>]
*) SECURITY: CVE-2013-5704 (cve.mitre.org)
core: HTTP trailers could be used to replace HTTP headers
late during request processing, potentially undoing or
otherwise confusing modules that examined or modified
request headers earlier. Adds "MergeTrailers" directive to restore
legacy behavior. [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener]
*) mod_buffer: Forward flushed input data immediately and avoid (unlikely)
access to freed memory. [Yann Ylavic, Christophe Jaillet]
Jeff Trawick
committed
*) core: Add CGIPassAuth directive to control whether HTTP authorization
headers are passed to scripts as CGI variables. PR 56855. [Jeff
Trawick]
*) mod_ssl: New directive SSLSessionTickets (On|Off).
The directive controls the use of TLS session tickets (RFC 5077),
default value is "On" (unchanged behavior).
Session ticket creation uses a random key created during web
server startup and recreated during restarts. No other key
recreation mechanism is available currently. Therefore using session
tickets without restarting the web server with an appropriate frequency
(e.g. daily) compromises perfect forward secrecy. [Rainer Jung]
*) mod_proxy_fcgi: Provide some basic alternate options for specifying
how PATH_INFO is passed to FastCGI backends by adding significance to
the value of proxy-fcgi-pathinfo. PR 55329. [Eric Covener]
*) mod_proxy_fcgi: Enable UDS backends configured with SetHandler/RewriteRule
to opt-in to connection reuse and other Proxy options via explicitly
declared "proxy workers" (<Proxy unix:... enablereuse=on max=...)
[Eric Covener]
*) mod_proxy: Add "enablereuse" option as the inverse of "disablereuse".
[Eric Covener]
*) mod_proxy_fcgi: Enable opt-in to TCP connection reuse by explicitly
setting proxy option disablereuse=off. [Eric Covener] PR 57378.
*) event: Update the internal "connection id" when requests
move from thread to thread. Reuse can confuse modules like
mod_cgid. PR 57435. [Michael Thorpe <mike gistnet.com>]
*) mod_proxy_fcgi: Remove proxy:balancer:// prefix from SCRIPT_FILENAME
Loading full blame...