*) SECURITY: CVE-2007-3847 (cve.mitre.org)
mod_proxy: Prevent reading past the end of a buffer when parsing
date-related headers. PR 41144.
[Davi Arnaut, Nick Kew]
*) SECURITY: CVE-2007-1863 (cve.mitre.org)
mod_cache: Prevent a segmentation fault if attributes are listed in a
Cache-Control header without any value.
[Niklas Edmundsson <nikke acc.umu.se>]
*) SECURITY: CVE-2007-3304 (cve.mitre.org)
prefork, worker, event MPMs: Ensure that the parent process cannot
be forced to kill processes outside its process group.
[Joe Orton, Jim Jagielski]
*) SECURITY: CVE-2006-5752 (cve.mitre.org)
mod_status: Fix a possible XSS attack against a site with a public
server-status page and ExtendedStatus enabled, for browsers which
perform charset "detection". Reported by Stefan Esser. [Joe Orton]
*) SECURITY: CVE-2007-1862 (cve.mitre.org)
mod_mem_cache: Copy headers into longer lived storage; header names and
values could previously point to cleaned up storage. PR 41551.
[Davi Arnaut <davi haxent.com.br>]
*) mod_mem_cache: Increase the minimum and default value for
MCacheMinObjectSize from 0 to 1, as a MCacheMinObjectSize of 0 does not
make sense and leads to a division by zero. PR 40576.
[Xuekun Hu <xuekun.hu gmail.com>]
*) mod_cache: Remove expired content from cache that cannot be revalidated.
PR 30370. [Ruediger Pluem]
*) mod_proxy_http: accept proxy-sendchunked/proxy-sendchunks as synonymous.
PR 43183 [Brian Rectanus <Brian.Rectanus breach.com>, Vincent Bray]
*) mod_proxy: Ensure that at least scheme://hostname[:port] matches between
worker and URL when searching for the best fitting worker for a given URL.
PR 40910 [Ruediger Pluem]
*) mod_proxy: Improve network performance by setting APR_TCP_NODELAY
(disable Nagle algorithm) on sockets if implemented.
PR 42871 [Christian BOITEL <christian_boitel yahoo.fr>, Jim Jagielski]
*) core: Do not replace a Date header set by a proxied backend server.
PR 40232 [Ruediger Pluem]
*) mod_proxy: Add a missing assignment in an error checking code path.
PR 40865 [Andrew Rucker Jones <arjones simultan.dyndns.org>]
*) mod_proxy_connect: avoid segfault on DNS lookup failure.
PR 40756 [Trevin Beattie <tbeattie boingo.com>]
*) mod_proxy_http: Don't try to read body of a HEAD request before
responding. PR 41644 [Stuart Children <stuart terminus.co.uk>]
*) mod_authnz_ldap: Don't return HTTP_UNAUTHORIZED during authorization when
LDAP authentication is configured but we haven't seen any
'Require ldap-*' directives, allowing authorization to be passed to lower
level modules (e.g. Require valid-user)
PR 43281 [Eric Covener]
*) proxy/ajp_header.c: Fixed header token string comparisons
Matching of header tokens failed to include the trailing NIL byte
and could misinterpret a longer header token for a shorter.
Additionally, a "Content-Type" comparison was made case insensitive.
[Martin Kraemer]
*) proxy/ajp_header.c: Backport of an AJP protocol fix for EBCDIC
On EBCDIC machines, the status_line string was incorrectly converted
twice. [Jean-Frederic Clere, Martin Kraemer]
*) mod_dumpio: Fix for correct dumping of traffic on EBCDIC hosts
Data had been incorrectly converted twice, resulting in
garbled log output. [Martin Kraemer]
*) mod_autoindex: Add in Type and Charset options to IndexOptions
directive. This allows the admin to explicitly set the
content-type and charset of the generated page and is therefore
a viable workaround for buggy browsers affected by CVE-2007-4465
(cve.mitre.org). [Jim Jagielski]
*) log core: ensure we use a special pool for stderr logging, so that
the stderr channel remains valid from the time plog is destroyed,
until the time the open_logs hook is called again. [William Rowe]
*) mod_negotiation: preserve Query String in resolving a type map
PR 33112 [J酶rgen Thomsen <apache jth.net>, Nick Kew]
*) mod_ssl: Version reporting update; displays 'compiled against'
Apache and build-time SSL Library versions at loglevel [info],
while reporting the run-time SSL Library version in the server
info tags. Helps to identify a mod_ssl built against one flavor
of OpenSSL but running against another (also adds SSL-C version
number reporting.) [William Rowe]
*) mime.types: Many updates to sync with IANA registry and common
unregistered types that the owners refuse to register. Admins
are encouraged to update their installed mime.types file.
PR: 35550, 37798, 39317, 31483 [Roy T. Fielding]
*) mod_expires: don't crash on bad configuration data
PR 43213 [Julien Perez <julien.perez epsylonia.net>]
*) mod_dbd: Introduce configuration groups to allow inheritance by virtual
hosts of database configurations from the main server. Determine the
minimal set of distinct configurations and share connection pools
whenever possible. Allow virtual hosts to override inherited SQL
statements. PR 41302. [Chris Darroch]
*) mod_dbd: Create memory sub-pools for each DB connection and close
DB connections in a pool cleanup function. Ensure prepared statements
are destroyed before DB connection is closed. When using reslists,
prevent segfaults when child processes exit, and stop memory leakage
of ap_dbd_t structures. Avoid use of global s->process->pool, which
isn't destroyed by exiting child processes in most multi-process MPMs.
PR 39985. [Chris Darroch, Nick Kew]
*) mod_dbd: Handle error conditions in dbd_construct() properly.
Simplify ap_dbd_open() and use correct arguments to apr_dbd_error()
when non-threaded. Register correct cleanup data in non-threaded
ap_dbd_acquire() and ap_dbd_cacquire(). Clean up configuration data
and merge function. Use ap_log_error() wherever possible.
[Chris Darroch, Nick Kew]
*) mod_dbd: Stash DBD connections in request_config of initial request
only, or else sub-requests and internal redirections may cause
entire DBD pool to be stashed in a single HTTP request. [Chris Darroch]
*) main core: Emit errors during the initial apr_app_initialize()
or apr_pool_create() (when apr-based error reporting is not ready).
[William Rowe, Jeff Trawick]
*) log core: fix the new piped logger case where we couldn't connect
the replacement stderr logger's stderr to the NULL stdout stream.
Continue in this case, since the previous alternative of no error
logging at all (/dev/null) is far worse. [William Rowe]
*) mpm_winnt: Prevent the parent-child pipe from leaking into other
spawned processes, and ensure we have a /Device/null handle for
stdout when running as-a-service. [William Rowe]
*) mod_ldap: Avoid possible crashes, hangs, and busy loops due to
improper merging of the cache lock in vhost config
PR 43164 [Eric Covener]
*) ApacheMonitor: Fix Windows Vista detection. [Mladen Turk]
*) mod_filter: fix merging of ! and = in FilterChain
PR 42186 [Issac Goldstand <margol beamartyr.net>]
*) mod_deflate: don't try to process metadata buckets as data. what should
have been a 413 error was logged as a 500 and a blank screen appeared
at the browser.
[Greg Ames, Ruediger Pluem]
*) mod_cgi, mod_cgid: Fix use of CGI scripts as ErrorDocuments.
PR 39710. [Paul Querna, Ruediger Pluem]
*) mod_proxy: Allow to use different values for sessionid
in url encoded id and cookies. PR 41897. [Jean-Frederic Clere]
*) mod_proxy: Fix the 503 returned when session route does
not match any of the balancer members. [Mladen Turk]
*) mod_proxy: Added ProxyPassMatch directive, which is similar
to ProxyPass but takes a regex local path prefix. [Jim Jagielski]
*) mod_cache: Do not set Date or Expires when they are missing from
the original response or are invalid. [Justin Erenkrantz]
*) mod_cache: Correctly handle HEAD requests on expired cache content.
PR 41230. [Niklas Edmundsson <nikke acc.umu.se>]
*) mod_cache: Let Cache-Control max-age set the expiration of the cached
representation if Expires is not set. [Justin Erenkrantz]
*) mod_cache: Allow caching of requests with query arguments when
Cache-Control max-age is explicitly specified. [Justin Erenkrantz]
*) mod_disk_cache: Allow Vary'd responses to be refreshed properly.
[Justin Erenkrantz]
*) mod_proxy: Print the correct error message for erroneous configured
ProxyPass directives. PR 40439. [Takashi Sato <serai lans-tv.com>]
*) mod_so: Provide more helpful LoadModule feedback when an error occurs.
[William Rowe]
*) mod_cache: While serving a cached entity ensure that filters that have
been applied to this cached entity before saving it to the cache are not
applied again. PR 40090. [Ruediger Pluem]
*) mod_cache: Correctly cache objects whose URL query string has been
modified by mod_rewrite. PR 40805. [Ruediger Pluem]
*) HTTP proxy ProxyErrorOverride: Leave 1xx and 3xx responses alone. Only
processing of error responses (4xx, 5xx) will be altered. PR 39245.
[Jeff Trawick, Bart van der Schans <schans hippo.nl>]
*) htdbm: Enable crypt support on platforms with crypt() but not
<crypt.h>, such as z/OS. [David Jones <oscaremma gmail.com>]
*) mod_ssl: initialize thread locks before initializing the hardware
acceleration library, so the latter can make use of the former.
PR 20951. [<adunn at ncipher.com>]
*) ab.c: Correct behavior of HTTP request headers sent by ab
in presence of -H command-line overrides. PR 31268, 26554.
[Arvind Srinivasan <arvind.srinivasan sun.com>]
*) ab.c: The apr_port_t type is unsigned, but ab was using a
signed format code in its reports. PR 42070.
[Takashi Sato <serai lans-tv.com>]
*) mod_ldap: Remove the hardcoded size limit parameter for
ldap_search_ext_s and replace it with an APR_ defined
value that is set according to the LDAP SDK being used.
[David Jones <oscaremma gmail com>]
*) core: Correct a regression since 2.0.x in the handling of AllowOverride
Options. PR 41829. [Torsten F枚rtsch <torsten.foertsch gmx.net>]
*) mod_proxy_http: Handle request bodies larger than 2 GB by converting
the Content-Length header of the request correctly. PR 40883.
[Ruediger Pluem, toadie <toadie643 gmail.com>]
*) mod_proxy: Fix some proxy setting inheritance problems (eg:
ProxyTimeout). PR 11540. [Stuart Children <stuart terminus.co.uk>]
*) Unix MPMs: Catch SIGFPE so that exception hooks and CoreDumpDirectory
can work after that terminating signal.
[Eric Covener]
*) Win32: Makefile.win will now build with MS VC 8 (Visual Studio 2005)
including embedding the .manifest information into each binary.
[William Rowe]