Skip to content
CHANGES 183 KiB
Newer Older
Jeff Trawick's avatar
Jeff Trawick committed
                                                         -*- coding: utf-8 -*-
Ruediger Pluem's avatar
Ruediger Pluem committed

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.16

Yann Ylavic's avatar
Yann Ylavic committed
  *) http: Fix LimitRequestBody checks when there is no more bytes to read.
     [Michael Kaufmann <mail michael-kaufmann.ch>]
Jim Jagielski's avatar
Jim Jagielski committed

  *) mod_alias: Revert expression parser support for Alias, ScriptAlias
     and Redirect due to a regression (introduced in 2.4.13, not released).
  *) mod_reqtimeout: Don't let pipelining checks and keep-alive times interfere
     with the timeouts computed for subsequent requests.  PR 56729.
     [Eric Covener, Yann Ylavic]

  *) core: Avoid a possible truncation of the faulty header included in the
     HTML response when LimitRequestFieldSize is reached.  [Yann Ylavic]

  *) mod_ldap: In some case, LDAP_NO_SUCH_ATTRIBUTE could be returned instead
     of an error during a compare operation. [Eric Covener]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.15

  *) mod_ext_filter, mod_charset_lite: Avoid inadvertent filtering of protocol
     data during read of chunked request bodies. PR 58049. 
     [Edward Lu <Chaosed0 gmail.com>]

  *) mod_ldap: Stop leaking LDAP connections when 'LDAPConnectionPoolTTL 0' 
     is configured.  PR 58037.  [Ted Phelps <phelps gnusto.com>]

  *) core: Allow spaces after chunk-size for compatibility with implementations
     using a pre-filled buffer.  [Yann Ylavic, Jeff Trawick]

  *) mod_ssl: Remove deprecated SSLCertificateChainFile warning.
     [Yann Ylavic]
Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.14

  *) SECURITY: CVE-2015-3183 (cve.mitre.org)
     core: Fix chunk header parsing defect.
     Remove apr_brigade_flatten(), buffering and duplicated code from
     the HTTP_IN filter, parse chunks in a single pass with zero copy.
     Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
     authorized characters.  [Graham Leggett, Yann Ylavic]
  *) SECURITY: CVE-2015-3185 (cve.mitre.org)
     Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
     with new ap_some_authn_required and ap_force_authn hook.  [Ben Reser]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.13

Eric Covener's avatar
Eric Covener committed
  *) SECURITY: CVE-2015-0253 (cve.mitre.org)
Eric Covener's avatar
Eric Covener committed
     core: Fix a crash with ErrorDocument 400 pointing to a local URL-path 
     with the INCLUDES filter active, introduced in 2.4.11. PR 57531. 
     [Yann Ylavic]
Eric Covener's avatar
Eric Covener committed
  *) SECURITY: CVE-2015-0228 (cve.mitre.org)
     mod_lua: A maliciously crafted websockets PING after a script
     calls r:wsupgrade() can cause a child process crash. 
     [Edward Lu <Chaosed0 gmail.com>]

  *) mod_proxy: Don't put the worker in error state for 500 or 503 errors
     returned by the backend unless failonstatus is configured to.  PR 56925.
     [Yann Ylavic]

  *) core: Don't lowercase the argument to SetHandler if it begins with
     "proxy:unix". PR 57968. [Eric Covener]

  *) mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing
     the OCSP response for a different certificate.  mod_ssl has an additional
     global mutex, "ssl-stapling-refresh".  PR 57131 (partial fix).
     [Jeff Trawick]
Joe Orton's avatar
Joe Orton committed
  *) mod_authz_dbm: Fix crashes when "dbm-file-group" is used and
     authz modules were loaded in the "wrong" order.  [Joe Orton]

  *) mod_authn_dbd, mod_authz_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
     of DB lookup entries independently of the selected DB engine.  PR 46421.
     [Steven whitson <steven.whitson gmail com>, Jan Kaluza, Yann Ylavic].

  *) In alignment with RFC 7525, the default recommended SSLCipherSuite
     and SSLProxyCipherSuite now exclude RC4 as well as MD5. Also, the
     default recommended SSLProtocol and SSLProxyProtocol directives now
     exclude SSLv3. Existing configurations must be adjusted by the
     administrator. [William Rowe]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: Add support for extracting subjectAltName entries of type
     rfc822Name and dNSName into SSL_{CLIENT,SERVER}_SAN_{Email,DNS}_n
     environment variables. Also addresses PR 57207. [Kaspar Brand]

  *) dav_validate_request: avoid validating locks and ETags when there are
     no If headers providing them on a resource we aren't modifying.
     [Ben Reser]

  *) mod_proxy_scgi: ProxySCGIInternalRedirect now allows an alternate
     response header to be used by the application, for when the application
     or framework is unable to return Location in the internal-redirect
     form.  [Jeff Trawick]

  *) core: Cleanup the request soon/even if some output filter fails to
     handle the EOR bucket.  [Yann Ylavic]

  *) mpm_event: Allow for timer events duplicates. [Jim Jagielski, Yann Ylavic]

  *) mod_proxy, mod_ssl, mod_cache_socache, mod_socache_*: Support machine
     readable server-status produced when using the "?auto" query string.
     [Rainer Jung]

  *) mod_status: Add more data to machine readable server-status produced
     when using the "?auto" query string.  [Rainer Jung]

  *) mod_ssl: Check for the Entropy Gathering Daemon (EGD) availability at
     configure time (RAND_egd), and complain if SSLRandomSeed requires using
     it otherwise.  [Bernard Spil <pil.oss gmail com>, Stefan Sperling,
     Kaspar Brand]

  *) mod_ssl: make sure to consistently output SSLCertificateChainFile
     deprecation warnings, when encountered in a VirtualHost block.
     [Falco Schwarz <hiding falco.me>]

  *) mod_log_config: Add "%{UNIT}T" format to output request duration in
     seconds, milliseconds or microseconds depending on UNIT ("s", "ms", "us").
     [Ben Reser, Rainer Jung]
  *) Allow FallbackResource to work when a directory is requested and
     there is no autoindex nor DirectoryIndex. 
     [Jack <tjerk.meesters gmail.com>, Eric Covener]

  *) mod_proxy_wstunnel: Bypass the handler while the connection is not
     upgraded to WebSocket, so that other modules can possibly take over
     the leading HTTP requests.  [Yann Ylavic]

  *) mod_http: Fix incorrect If-Match handling. PR 57358
     [Kunihiko Sakamoto <ksakamoto google.com>]

  *) mod_ssl: Add a warning if protocol given in SSLProtocol or SSLProxyProtocol
     will override other parameters given in the same directive. This could be
     a missing + or - prefix.  PR 52820 [Christophe Jaillet]

  *) core, modules: Avoid error response/document handling by the core if some
     handler or input filter already did it while reading the request (causing
     a double response body).  [Yann Ylavic]

  *) mod_proxy_ajp: Fix client connection errors handling and logged status
     when it occurs.  PR 56823.  [Yann Ylavic]

Eric Covener's avatar
Eric Covener committed
  *) mod_proxy: Use the correct server name for SNI in case the backend
     SSL connection itself is established via a proxy server.
     PR 57139 [Szabolcs Gyurko <szabolcs gyurko.org>]

Eric Covener's avatar
Eric Covener committed
  *) mod_ssl: Fix possible crash when loading server certificate constraints.
     PR 57694. [Paul Spangler <paul.spangler ni com>, Yann Ylavic]

  *) build: Don't load both mod_cgi and mod_cgid in the default configuration
     if they're both built.  [olli hauer <ohauer gmx.de>]

  *) mod_logio: Add LogIOTrackTTFB and %^FB logformat to log the time 
     taken to start writing response headers. [Eric Covener]

Jeff Trawick's avatar
Jeff Trawick committed
  *) mod_ssl: Avoid compilation errors with LibreSSL related to
     the use of ENGINE_CTRL_CHIL_SET_FORKCHECK. 
     [Stuart Henderson <sthen openbsd.org>]

  *) mod_proxy_http: Use the "Connection: close" header for requests to
     backends not recycling connections (disablereuse), including the default
     reverse and forward proxies.  [Yann Ylavic]

  *) mod_proxy: Add ap_connection_reusable() for checking if a connection
     is reusable as of this point in processing.  [Jeff Trawick]

  *) mod_proxy_wstunnel: Avoid an empty response by failing with 502 (Bad
     Gateway) when no response is ever received from the backend.
     [Jan Kaluza]

  *) core_filters: Restore/disable TCP_NOPUSH option after non-blocking
  *) mod_buffer: Forward flushed input data immediately and avoid (unlikely)
     access to freed memory. [Yann Ylavic, Christophe Jaillet]

  *) core: Add CGIPassAuth directive to control whether HTTP authorization
     headers are passed to scripts as CGI variables.  PR 56855.  [Jeff 
     Trawick]

  *) core: Initialize scoreboard's used optional functions on graceful restarts
     to avoid a crash when relocation occurs.  PR 57177.  [Yann Ylavic]

  *) mod_dav: Avoid a potential integer underflow in the lock timeout value sent
     back to a client. The answer to a LOCK request could be an extremly large
     integer if the time needed to lock the resource was longer that the
     requested timeout given in the LOCK request. In such a case, we now answer
     "Second-0".  PR55420
     [Christophe Jaillet]

  *) mod_cgid: Within the first minute of a server start or restart, 
     allow mod_cgid to retry connecting to its daemon process. Previously,
     'No such file or directory: unable to connect to cgi daemon...' could
     be logged without an actual retry. PR57685. 
     [Edward Lu <Chaosed0 gmail.com>]
     
  *) mod_proxy: Use the original (non absolute) form of the request-line's URI
Loading full blame...