2010年6月20日

[installer 2409] apache-2.3.6

apache-2.3.6 が出ています。

http://www.apache.org/dist/httpd/Announcement2.3.txt には alpha
リリースとありますが、ソースの tarball のファイル名からは -alpha が
取れています。

☆ apache-2.3.6
http://httpd.apache.org/

http://www.apache.org/dist/httpd/httpd-2.3.6.tar.gz

Changes with Apache 2.3.6

*) SECURITY: CVE-2009-3555 (cve.mitre.org)
mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection
attack when compiled against OpenSSL version 0.9.8m or later. Introduces
the 'SSLInsecureRenegotiation' directive to reopen this vulnerability
and offer unsafe legacy renegotiation with clients which do not yet
support the new secure renegotiation protocol, RFC 5746.
[Joe Orton, and with thanks to the OpenSSL Team]

*) SECURITY: CVE-2009-3555 (cve.mitre.org)
mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
by rejecting any client-initiated renegotiations. Forcibly disable
keepalive for the connection if there is any buffered data readable. Any
configuration which requires renegotiation for per-directory/location
access control is still vulnerable, unless using OpenSSL >= 0.9.8l.
[Joe Orton, Ruediger Pluem, Hartmut Keil <Hartmut.Keil adnovum.ch>]

*) SECURITY: CVE-2010-0408 (cve.mitre.org)
mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent
when request headers indicate a request body is incoming; not a case of
HTTP_INTERNAL_SERVER_ERROR. [Niku Toivola <niku.toivola sulake.com>]

*) SECURITY: CVE-2010-0425 (cve.mitre.org)
mod_isapi: Do not unload an isapi .dll module until the request
processing is completed, avoiding orphaned callback pointers.
[Brett Gervasoni <brettg senseofsecurity.com>, Jeff Trawick]

*) core: Filter init functions are now run strictly once per request
before handler invocation. The init functions are no longer run
for connection filters. PR 49328. [Joe Orton]

*) core: Adjust the output filter chain correctly in an internal
redirect from a subrequest, preserving filters from the main
request as necessary. PR 17629. [Joe Orton]

*) mod_cache: Explicitly allow cache implementations to cache a 206 Partial
Response if they so choose to do so. Previously an attempt to cache a 206
was arbitrarily allowed if the response contained an Expires or
Cache-Control header, and arbitrarily denied if both headers were missing.
[Graham Leggett]

*) core: Add microsecond timestamp fractions, process id and thread id
to the error log. [Rainer Jung]

*) configure: The "most" module set gets build by default. [Rainer Jung]

*) configure: Building dynamic modules (DSO) by default. [Rainer Jung]

*) configure: Fix broken VPATH build when using included APR.
[Rainer Jung]

*) mod_session_crypto: Fix configure problem when building
with APR 2 and for VPATH builds with included APR.
[Rainer Jung]

*) mod_session_crypto: API compatibility with APR 2 crypto and
APR Util 1.x crypto. [Rainer Jung]

*) ab: Fix memory leak with -v2 and SSL. PR 49383.
[Pavel Kankovsky <peak argo troja mff cuni cz>]

*) core: Add per-module and per-directory loglevel configuration.
Add some more trace logging.
mod_rewrite: Replace RewriteLog/RewriteLogLevel with trace log levels.
mod_ssl: Replace LogLevelDebugDump with trace log levels.
mod_ssl/mod_proxy*: Adjust loglevels to be less verbose at levels info
and debug.
mod_dumpio: Replace DumpIOLogLevel with trace log levels.
[Stefan Fritsch]

*) mod_ldap: LDAP caching was suppressed (and ldap-status handler returns
title page only) when any mod_ldap directives were used in VirtualHost
context. [Eric Covener]

*) mod_disk_cache: Decline the opportunity to cache if the response is
a 206 Partial Content. This stops a reverse proxied partial response
from becoming cached, and then being served in subsequent responses.
[Graham Leggett]

*) mod_deflate: avoid the risk of forwarding data before headers are set.
PR 49369 [Matthew Steele <mdsteele google.com>]

*) mod_authnz_ldap: Ensure nested groups are checked when the
top-level group doesn't have any direct non-group members
of attributes in AuthLDAPGroupAttribute. [Eric Covener]

*) mod_authnz_ldap: Search or Comparison during authorization phase
can use the credentials from the authentication phase
(AuthLDAPSearchAsUSer,AuthLDAPCompareAsUser).
PR 48340 [Domenico Rotiroti, Eric Covener]

*) mod_authnz_ldap: Allow the initial DN search during authentication
to use the HTTP username/pass instead of an anonymous or hard-coded
LDAP id (AuthLDAPInitialBindAsUser, AuthLDAPInitialBindPattern).
[Eric Covener]

*) mod_authnz_ldap: Publish requested LDAP data with an AUTHORIZE_ prefix
when this module is used for authorization. See AuthLDAPAuthorizePrefix.
PR 45584 [Eric Covener]

*) apxs -q: Stop filtering out ':' characters from the reported values.
PR 45343. [Bill Cole]

*) prefork MPM: Run cleanups for final request when process exits gracefully.
PR 43857. [Tom Donovan]

*) ab: fix number of requests sent by ab when keepalive is enabled. PR 48497.
[Bryn Dole <dole blekko.com>]

*) Log an error for failures to read a chunk-size, and return 408 instead of
413 when this is due to a read timeout. This change also fixes some cases
of two error documents being sent in the response for the same scenario.
[Eric Covener] PR49167

*) mod_proxy_balancer: Add new directive BalancerNonce to allow admin
to control/set the nonce used in the balancer-manager application.
[Jim Jagielski]

*) mod_proxy_connect: Support port ranges in AllowConnect. PR 23673.
[Stefan Fritsch]

*) Proxy balancer: support setting error status according to HTTP response
code from a backend. PR 48939. [Daniel Ruggeri <DRuggeri primary.net>]

*) htcacheclean: Introduce the ability to clean specific URLs from the
cache, if provided as an optional parameter on the command line.
[Graham Leggett]

*) core: Introduce the IncludeStrict directive, which explicitly fails
server startup if no files or directories match a wildcard path.
[Graham Leggett]

*) htcacheclean: Report additional statistics about entries deleted.
PR 48944. [Mark Drayton mark markdrayton.info]

*) Introduce SSLFIPS directive to support OpenSSL FIPS_mode; permits all
builds of mod_ssl to use 'SSLFIPS off' for portability, but the proper
build of openssl is required for 'SSLFIPS on'. PR 46270.
[Dr Stephen Henson <steve openssl.org>, William Rowe]

*) mod_proxy_http: Log the port of the remote server in various messages.

投稿者 xml-rpc : 2010年6月20日 03:18
役に立ちました?:
過去のフィードバック 平均:(0) 総合:(0) 投票回数:(0)
本記事へのTrackback: http://hoop.euqset.org/blog/mt-tb2006.cgi/96510
トラックバック
コメント
コメントする




画像の中に見える文字を入力してください。