261de71c06
Changes with Apache 2.0.65
*) SECURITY: CVE-2013-1862 (cve.mitre.org)
mod_rewrite: Ensure that client data written to the RewriteLog is
escaped to prevent terminal escape sequences from entering the
log file. [Eric Covener, Jeff Trawick, Joe Orton]
*) SECURITY: CVE-2012-0053 (cve.mitre.org)
Fix an issue in error responses that could expose "httpOnly" cookies
when no custom ErrorDocument is specified for status code 400.
[Eric Covener]
*) SECURITY: CVE-2012-0031 (cve.mitre.org)
Fix scoreboard issue which could allow an unprivileged child process
to cause the parent to crash at shutdown rather than terminate
cleanly. [Joe Orton]
*) SECURITY: CVE-2011-3368 (cve.mitre.org)
Reject requests where the request-URI does not match the HTTP
specification, preventing unexpected expansion of target URLs in
some reverse proxy configurations. [Joe Orton]
*) SECURITY: CVE-2011-3192 (cve.mitre.org)
core: Fix handling of byte-range requests to use less memory, to avoid
denial of service. If the sum of all ranges in a request is larger than
the original file, ignore the ranges and send the complete file.
bug#51714. [Jeff Trawick, Stefan Fritsch, Jim Jagielski, Ruediger Pluem,
Eric Covener, <lowprio20 gmail.com>]
*) SECURITY: CVE-2011-3607 (cve.mitre.org)
Fix integer overflow in ap_pregsub() which, when the mod_setenvif module
is enabled, could allow local users to gain privileges via a .htaccess
file. [Stefan Fritsch, Greg Ames]
NOTE: it remains possible to exhaust all memory using a carefully
crafted .htaccess rule, which will not be addressed in 2.0; enabling
processing of .htaccess files authored by untrusted users is the root
of such security risks. Upgrade to httpd 2.2.25 or later to limit
this specific risk.
*) core: Add MaxRanges directive to control the number of ranges permitted
before returning the entire resource, with a default limit of 200.
[Eric Covener, Rainer Jung]
*) Set 'Accept-Ranges: none' in the case Ranges are being ignored with
MaxRanges none. [Eric Covener, Rainer Jung]
*) mod_rewrite: Allow merging RewriteBase down to subdirectories
if new option 'RewriteOptions MergeBase' is configured.
[Eric Covener]
*) mod_rewrite: Fix the RewriteEngine directive to work within a
location. Previously, once RewriteEngine was switched on globally,
it was impossible to switch off. [Graham Leggett]
*) mod_rewrite: Add "AllowAnyURI" option. bug#52774. [Joe Orton]
*) htdigest: Fix buffer overflow when reading digest password file
with very long lines. bug#54893. [Rainer Jung]
*) mod_ssl: Add "SSLHonorCipherOrder" directive to enable the
OpenSSL 0.9.7 flag which uses the server's cipher order rather
than the client's. bug#28665.
[Jim Schneider <jschneid netilla.com>]
*) mod_include: Prevent a case of SSI timefmt-smashing with filter chains
including multiple INCLUDES filters. bug#39369 [Joe Orton]
*) mod_rewrite: When evaluating a proxy rule in directory context, do
escape the filename by default. bug#46428 [Joe Orton]
*) Improve platform detection for bundled PCRE by updating config.guess
and config.sub. [Rainer Jung]
*) ssl-std.conf: Disable AECDH ciphers in example config. bug#51363.
[Rob Stradling <rob comodo com>]
*) ssl-std.conf: Change the SSLCipherSuite default to a shorter,
whitelist oriented definition. [Rainer Jung, Kaspar Brand]
*) ssl-std.conf: Only select old MSIE browsers for the downgrade
in http/https behavior. [Greg Stein, Stefan Fritsch]
18 lines
1,014 B
Text
18 lines
1,014 B
Text
$NetBSD: distinfo,v 1.59 2013/08/04 02:45:42 obache Exp $
|
|
|
|
SHA1 (httpd-2.0.65.tar.bz2) = 0183866df73c7877ba9275a075a2ece7a67f6c95
|
|
RMD160 (httpd-2.0.65.tar.bz2) = 1f0142a843486a53ba184ceb9214dc78f071e17e
|
|
Size (httpd-2.0.65.tar.bz2) = 4999802 bytes
|
|
SHA1 (patch-aa) = bff1ef591f5361e7169ff9005dcf86437b9dac23
|
|
SHA1 (patch-ab) = 32c47bd5087269f530b7d52d6a1a719a50ae7260
|
|
SHA1 (patch-ac) = 7854294ae9c7fdcf7d6c9f5f2bee526952e583e3
|
|
SHA1 (patch-ad) = 088d6ff0e7a8acfe70b4f85a6ce58d42c935fd13
|
|
SHA1 (patch-ae) = 26bea7ea9498437fa2436710849cbb00a4159442
|
|
SHA1 (patch-af) = 8400ae084e31026e9d8143a0246aa3e65166f380
|
|
SHA1 (patch-ag) = 78dcb023f524ef65928b529320932c9664ec0d01
|
|
SHA1 (patch-ah) = 241e9083a82d465d2a1a5a116b11512ef1226f1a
|
|
SHA1 (patch-ai) = 4dc88c15b0525a5aabc80d5c2a0720cd260629de
|
|
SHA1 (patch-ak) = f11a86b1235d5c595fa381bbb474db4fe8448215
|
|
SHA1 (patch-al) = 9af7b6c56177d971e135f0a00b3ab9ded5d1b6dd
|
|
SHA1 (patch-am) = ab4a2f7e5a1a3064e908b61157e7fd349c0b0c08
|
|
SHA1 (patch-ao) = c629a7563d0e555922526e26b266251144a14ff6
|